Email Deliverability

Also Known As

TL;DR

Explanation

SPF (Sender Policy Framework): a DNS TXT record listing authorised sending IPs for your domain. DKIM (DomainKeys Identified Mail): cryptographic signature on outgoing emails, verified by recipients using a public key in DNS. DMARC (Domain-based Message Authentication): policy defining what to do when SPF/DKIM fail (none, quarantine, reject) and where to send reports. Sending reputation is built on low bounce rates, low spam complaint rates, and consistent sending volume. PHP applications should use a transactional email service (SendGrid, Postmark, SES) rather than server SMTP.

Diagram

flowchart LR
    PHP[PHP App] -->|SMTP| MTA1[Sending MTA<br/>sendgrid.net]
    MTA1 -->|DNS MX lookup| MTA2[Receiving MTA<br/>gmail.com]
    MTA2 --> FILTER{Spam Filter}
    FILTER -->|SPF pass| FILTER2{DKIM check}
    FILTER2 -->|valid signature| INBOX[Inbox]
    FILTER -->|SPF fail| SPAM[Spam / Rejected]
    FILTER2 -->|invalid| SPAM
    DNS[DNS Records:<br/>SPF TXT record<br/>DKIM TXT record<br/>DMARC TXT record] -.->|validates| FILTER & FILTER2
style INBOX fill:#238636,color:#fff
style SPAM fill:#f85149,color:#fff
style DNS fill:#1f6feb,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Using server's own SMTP for transactional email — shared hosting IP reputation is poor; use a dedicated sending service.
• SPF record with too many DNS lookups — SPF has a 10 DNS lookup limit; exceeding it causes SPF failures.
• Not setting DMARC policy — without DMARC, spoofed emails from your domain bypass SPF/DKIM failures.
• Not monitoring bounce rates — high bounce rates signal ISPs to start filtering your email.

Code Examples

// Using PHP mail() directly — poor deliverability:
mail('user@example.com', 'Reset Password', $body);
// Sent from shared hosting IP with no SPF/DKIM/DMARC
// Goes straight to spam or rejected

// Transactional email service with authentication:
// DNS records required:
// TXT @ 'v=spf1 include:sendgrid.net ~all'
// TXT s1._domainkey 'v=DKIM1; k=rsa; p=<public_key>'
// TXT _dmarc 'v=DMARC1; p=reject; rua=mailto:dmarc@example.com'

// PHP with SendGrid:
$email = new SendGrid\Mail\Mail();
$email->setFrom('noreply@example.com');
$email->addTo($userEmail);
$email->setSubject('Reset your password');
$email->addContent('text/html', $htmlBody);
$sendgrid = new SendGrid(getenv('SENDGRID_API_KEY'));
$sendgrid->send($email);

References

• ↗ https://www.cloudflare.com/learning/email-security/dmarc-dkim-spf/

Tags

Related Terms