SPF, DKIM and DMARC
Three DNS-based checks that email providers run on your domain to verify that mail genuinely comes from you and has not been tampered with.
SPF lists the servers authorized to send on your behalf. Without it, anyone can send from your domain.
DKIM signs each message with a cryptographic key. The receiving server verifies the signature and knows the message was not altered in transit.
DMARC specifies what to do when SPF or DKIM fails: ignore it, quarantine it, or reject it. It also sends reports on impersonation attempts.
Three mechanisms, but not three lines to write: each is added as one or more DNS records in your domain's settings and propagates within minutes to a few hours.
In Mailcheer, six lines to copy — three of which are required. The Domains screen gives them with their exact values: three signing CNAMEs (DKIM), one MX and one TXT on a 'mail.' sending subdomain, one '_dmarc' TXT. Only the three CNAMEs are required before you can send. If your domain is on Cloudflare, one button adds these records for you, with a key you create and that Mailcheer does not keep. The SPF provided covers that subdomain and leaves your main domain's record untouched: Mailcheer does not merge any existing record. The DMARC provided is in monitoring mode — it surfaces reports without rejecting anything until you decide to tighten it.
Why it matters
Since February 2024, Gmail and Yahoo require these records for any bulk sender. Without them, your message goes to spam, or does not arrive at all.