Home / Categories / Deliverability
SPF, DKIM and DMARC, in plain English
SPF names the servers allowed to send for your domain, DKIM proves the message was not altered on the way, and DMARC says what happens when either check fails. systeme.io generates the records when you authenticate a domain, and you add them to your DNS.
What is email authentication and why does it decide everything?
Authentication is the proof that the server sending an email is allowed to send for that domain. Without it a receiving server has no way to tell a real message from a forged one.
Since February 2024, Gmail, Yahoo and Microsoft have tightened what they accept. systeme.io's documentation states that emails from senders using unauthenticated domains are automatically sent to the spam folder. Microsoft strengthened its own requirements again in May 2025.
It is also a hard gate inside the product. Authenticating a domain name is mandatory to send emails from systeme.io.
The three records, one line each
| Record | What it answers | What happens without it |
|---|---|---|
| SPF | Which servers may send for this domain | A failure brings a high risk of rejection or a spam label |
| DKIM | Has the message been altered since it was sent | Modern providers treat the email as less reliable |
| DMARC | What to do when SPF or DKIM fails | The domain is open to spoofing, and filters get more suspicious |
systeme.io's own summary is that the three together act as a technical passport, checked before the content of an email is analysed at all.
What systeme.io actually asks you to add
The setting sits under Settings, then Emails, in the Domains section. Entering the domain without the "www" and saving generates the records.
Three CNAME records then appear in a table, along with a DMARC record. Both have to be added to the DNS zone at your domain host.
The documented example values look like this:
| Type | Name | Value |
|---|---|---|
| CNAME | si942517 | inbound.systeme.io. |
| CNAME | systemeio1._domainkey | key1.systeme.io. |
| CNAME | systemeio2._domainkey | key2.systeme.io. |
Two of the three carry _domainkey in their names. systeme.io's documentation says that authenticating the domain adds the SPF and DKIM records to it, and names those three CNAMEs plus the DMARC record as what has to go into your DNS zone.
Two details in that table trip people up. In the Name field you enter only the part before your domain name, so si942517 and not si942517.yourdomain.com. In the Value field the address takes a full stop at the end.
The DMARC record is separate
It is a TXT record, not a CNAME. The name is _dmarc, and the documented starting value is v=DMARC1; p=none; rua=mailto:youraddress@yourdomain.com
The policy part of that value tells receiving servers how to handle mail that fails SPF or DKIM. systeme.io documents p=none as the value to use and does not set out what the other settings do.
The rua address receives a daily report from email providers, sent as raw XML. systeme.io recommends pointing it at an address created for that purpose rather than at your main inbox. Several addresses can be listed, separated by commas with no spaces.
A DNS zone can hold many TXT records, but there must be only one DMARC record per domain. Two of them conflict and the policy stops working.
The rules that catch people out
- The domain has to have a live homepage. If it leads to a 404 page, email providers may block your emails, and a parking page does not count.
- A domain can only be authenticated in one systeme.io account or sub-account. Adding one that is already authenticated elsewhere returns an error.
- Domains from personal email providers such as Gmail, Yahoo and ProtonMail cannot be authenticated. Only a custom domain can.
- Authentication is not the last step. The sender email address on that domain still has to be confirmed separately before it will send.
Checking it worked
systeme.io points at two outside checkers: a DNS checker for the three CNAMEs, entering the full name including your domain, and mxtoolbox for the DMARC record. A green tick against the exact value on all three CNAMEs means the domain is authenticated.
Records showing in red mean a DNS error to fix. systeme.io asks you to contact support after making the change either way, so the team can verify it from their side.
Did this answer your question?
Keep reading
- Is systeme.io free? Yes, and the free plan never expires. Here is exactly what fits inside it.
- Which systeme.io plan do I need? Count your contacts. That is nearly the whole decision.
- Should I build my website with a funnel or a blog? There is a third option, and it is the one their own help centre buries.