Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use three coordinated controls, not a Node.js-only fix: SPF authorizes the servers that send your SMTP envelope, DKIM adds a verifiable signature, and DMARC checks that at least one of those authenticated domains aligns with the visible From domain. DNS records and your email provider must be configured separately from the application. Node.js can submit a message or create a DKIM signature; it cannot publish DNS records or force a provider’s envelope domain to align.
This setup applies to transactional and promotional mail from a US or EU SaaS, but mailbox-provider rules are not the same as legal compliance. Consent, privacy, cross-border processing and commercial-email obligations depend on the recipients, message purpose, data and contracts involved.
What SPF, DKIM and DMARC each prove
Authentication is easier to troubleshoot when you keep the domains and jobs separate. A message normally has a visible From: header, an SMTP envelope sender (the MAIL FROM used for bounces), and, when DKIM is enabled, a signing domain identified by the d= tag.
| Layer | What it checks | Where it is configured | What a pass means |
|---|---|---|---|
| SPF | The envelope sender domain’s DNS policy against the host that delivered the message | TXT record at the envelope domain; provider sending path | The sending infrastructure is authorized for that envelope domain |
| DKIM | A cryptographic signature and the public key published for its selector | Provider or Node.js signer plus a DNS TXT record at <selector>._domainkey |
The signed headers/body were verified and the signing domain is known |
| DMARC | Whether SPF or DKIM passes and its authenticated domain aligns with the visible From domain |
TXT record at _dmarc.<domain> |
The message meets the domain owner’s policy; the policy can monitor, quarantine or reject |
DMARC can pass through either aligned SPF or aligned DKIM. Configuring both gives you resilience: a change in the provider’s bounce path is less likely to break authentication if the DKIM identity remains aligned. AWS describes the alignment rules and evaluation in its DMARC documentation.
#1 Best Overall
Decide your sending architecture before editing DNS
Inventory every sender
List your API, SMTP relays, background workers, support platform, billing system and marketing system. Every service that sends with your domain must be represented in SPF, DKIM or both. A domain may have only one SPF policy: publish one TXT record containing all authorized mechanisms rather than competing SPF records, which cause an SPF PermError.
Separate traffic when it improves control
Consider a subdomain such as tx.example.com for receipts and password resets and news.example.com for subscriptions. Separate subdomains let you change providers or DMARC enforcement for one stream without immediately affecting the other. They also make reputation and complaint data easier to interpret. Use the exact domains your provider supports; do not assume a subdomain is eligible for every custom MAIL FROM feature.
Choose who manages DKIM
- Provider-managed DKIM: the provider generates keys, gives you DNS records and signs after you verify the identity. This is usually the simplest operational path.
- Application-managed DKIM: Node.js holds a private key and signs messages. You must protect that key, publish its matching public key and keep the selector and signing domain synchronized across deployments.
Nodemailer documents both DKIM signing and the fact that SMTP envelope addresses are distinct from message headers at its DKIM documentation and its SMTP-envelope documentation. The visible From header alone does not determine SPF.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesPublish provider and domain settings in the right order
- Verify the sending identity in your provider. Add the parent domain or the specific subdomain and complete the provider’s ownership check. Keep a record of the region, account and identity each application uses.
- Enable DKIM and publish the supplied records. Your DNS host may ask for a host/name and a TXT value, or CNAME records for provider-managed keys. Copy them exactly, including the selector and any trailing dot conventions required by that DNS interface. Wait for public DNS propagation before declaring verification complete.
- Build one SPF record. Combine the provider’s authorized include or IP mechanism with any other legitimate sender. Do not add a service merely because it is installed; an unauthorized sender should not be able to use your envelope domain. SPF has DNS-lookup and syntax limits, so large collections of includes may need provider consolidation or delegated subdomains.
- Set the SMTP envelope deliberately. Configure the provider or Nodemailer transport so bounces use the envelope domain you intended. Nodemailer’s envelope is separate from headers, so a custom
Fromvalue does not replace this setting. - Add DMARC at
_dmarc.<domain>. Start with a monitoring policy when you are still discovering legitimate sources. Send aggregate reports to a mailbox or analysis service you control, review the authenticated sources and alignment, then decide whether quarantine or reject is appropriate. - Send test messages through every path. Use representative Gmail and non-Gmail recipients, then inspect the complete received headers for SPF result, DKIM result and signature domain, DMARC result and the domains shown for
header.from,smtp.mailfromandd=.
Amazon SES custom MAIL FROM: the concrete DNS pattern
Amazon SES illustrates why the provider layer cannot be replaced by application code. After verifying a parent identity, select a dedicated subdomain for custom MAIL FROM. SES requires an MX record and an SPF TXT record whose values it supplies and whose endpoint includes the SES region. The MX receives bounce and complaint notifications for that MAIL FROM domain. Follow the current instructions in Using a custom MAIL FROM domain.
Rank #2
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Do not use the custom MAIL FROM subdomain for ordinary inbound or outbound mail. It is a return-path service endpoint, not a general-purpose mailbox domain. If the MX or SPF value is copied from the wrong region, omitted, or placed at the parent domain instead of the dedicated subdomain, SES verification and SPF alignment can fail.
SES also explains that DMARC alignment compares the visible From domain with the MAIL FROM domain for SPF and with the DKIM signing domain for DKIM. Its SPF guidance is useful when checking which SES path is authorizing your envelope.
Node.js implementation: keep signing and transport explicit
A typical Nodemailer transport submits mail to your provider’s SMTP endpoint. The provider may perform DKIM signing after submission, or you can configure Nodemailer to sign before it sends. Do not enable both blindly: duplicate or conflicting signatures make diagnosis harder.
Free tools Windows power users keep installed
One-click scans. No signup required.
import nodemailer from 'nodemailer';
const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: Number(process.env.SMTP_PORT || 587),
secure: false,
auth: {
user: process.env.SMTP_USER,
pass: process.env.SMTP_PASSWORD
},
// The SMTP envelope is intentionally separate from the From header.
dkim: {
domainName: 'tx.example.com',
keySelector: process.env.DKIM_SELECTOR,
privateKey: process.env.DKIM_PRIVATE_KEY
}
});
await transporter.sendMail({
from: 'Billing <billing@example.com>',
to: recipient,
subject: 'Your receipt',
text: 'Receipt details',
envelope: {
from: 'bounces@tx.example.com',
to: recipient
}
});The domain, selector and private key in this example are placeholders for values you control. Publish the corresponding public key at the selector’s _domainkey DNS name. Store the private key in a secrets manager, restrict access, rotate it with a planned selector change and never commit it to source control. If your provider manages DKIM, remove application signing and use the provider’s records and configuration instead.
Rank #3
- 100% Satisfaction Warranty – Our servers book for waitress organization are handcrafted with elegant stitching that lasts. We take pride in offering our customers a waitress book made to exceptional quality standards. To ensure satisfaction, every waiters checkbook is backed by a 1-YEAR WARRANTY. If you are not 100% SATISFIED for any reason we will send you a replacement. No Questions Asked
- Holds up under Pressure – When you're taking orders the last thing you need is a flimsy waiter book that keeps bending. Our 8”x5” server books for waitress organization is the only one with a premium reinforced dual inner core. Providing an unmatched sturdy reliable writing surface that will last for years
- On Another Level – Halt the endless cycle of replacing your cheap thin black server book that barely lasts a week. This serving book for waitresses can become your permanent partner. Crafted with overwhelmingly strong attention to detail, the waiter checkbook offers an unparalleled value that you won’t regret investing in
- Scribble In Style – Impression is everything. You’re making a statement when you bring out this sleek vegan leather serving book. Our serving books have no logos or images and exquisite stitching for a professional feel your colleagues will envy
- Stay Calm and Collected – Whether you have 1 table or 7, organization is key. This server checkbook has 9 versatile pockets including a durable metal zipper to keep your cash secure. Stay on top of everything with this deluxe server book organizer and bring superior service to every customer
Use TLS for the SMTP connection, validate certificates, and keep credentials outside code. Application success only proves that the SMTP submission was accepted; it does not prove recipient authentication or inbox placement.
DMARC rollout without locking out legitimate mail
Start with visibility
A monitoring policy (p=none) requests reports without asking receivers to quarantine or reject failures. Use it while onboarding every sender, including forgotten scripts and third-party systems. Aggregate reports show source IPs, SPF and DKIM results and alignment, but they are not a substitute for reading individual failure headers.
Fix alignment, not just authentication
SPF may pass for a provider-owned envelope domain while DMARC still fails because that domain does not align with the visible From domain. Likewise, DKIM can pass for a provider domain that is unrelated to your From domain. Change the custom MAIL FROM, the DKIM signing domain, the From domain, or the provider’s alignment mode so at least one authenticated domain matches according to your selected strictness.
Enforce deliberately
After all legitimate sources pass consistently, choose quarantine or reject and consider a gradual percentage rollout. Keep an emergency rollback plan: a temporary policy change can stop accidental rejection, but it does not repair a missing sender or unauthorized DNS record.
Rank #4
Gmail requirements that matter in 2026
Google’s Email sender guidelines state that, beginning February 1, 2024, all senders to Gmail accounts must set up SPF or DKIM. For senders delivering more than 5,000 messages per day to Gmail accounts, Google requires SPF and DKIM, DMARC (which may initially be p=none), and alignment of the From domain with SPF or DKIM. That number is an operational Gmail threshold, not a universal definition of a bulk sender.
| Google requirement for bulk Gmail senders | Operational interpretation |
|---|---|
| SPF and DKIM | Authenticate both the envelope path and the message signature; do not rely on only one mechanism. |
| DMARC | Publish a DMARC record; monitoring mode is permitted while you establish visibility. |
| From alignment | At least SPF or DKIM must authenticate a domain aligned with the visible From domain. |
| TLS and DNS | Use TLS and maintain valid forward and reverse DNS for sending hosts where applicable. |
| Message quality | Send correctly formatted RFC 5322 messages and keep the spam rate below 0.3% as Google specifies. |
| Unsubscribe | Marketing and subscribed messages need one-click unsubscribe plus a visible body link. |
Google’s sender-guidelines FAQ says enforcement against non-compliant traffic is ramping up from November 2025. Its one-click requirement applies to marketing or promotional messages, not transactional mail such as password resets and confirmations. Google can change these operational rules, so check the live guidance before launch and during major volume changes.
Testing and troubleshooting by symptom
SPF shows pass but DMARC fails
Compare smtp.mailfrom with header.from. If they differ, SPF is authenticated but not aligned. Correct the envelope domain or use aligned DKIM.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDKIM shows fail
Check that the selector in the header exists publicly, the TXT value is complete, and the private key belongs to that public key. Body or header rewriting by a relay can invalidate a signature; sign as close to final delivery as practical.
Best Value
DMARC reports show an unknown sender
Identify the source IP and service, then either authorize and configure it or stop it from using your domain. Never add an unknown source to SPF merely to make a report look clean.
SES custom MAIL FROM is unverified
Confirm the MX and SPF records are on the exact dedicated subdomain, use the region-specific values SES supplied, and ensure the subdomain is not being used for normal mail. Recheck public DNS from outside your corporate resolver.
Mail is accepted but lands in spam
Authentication is necessary, not a delivery guarantee. Review Gmail’s TLS, DNS, formatting, complaint and unsubscribe requirements; monitor reputation and investigate sudden volume or complaint changes. A successful SMTP response means acceptance by the next server, not inbox placement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
US/EU SaaS compliance is a separate workstream
SPF, DKIM and DMARC establish technical identity and receiving-policy signals. They do not establish consent, a lawful basis, a privacy notice, a transfer mechanism, or permission to send marketing mail. The applicable US or EU rules depend on recipient location, whether a message is transactional or promotional, the personal data processed, your provider relationship and any cross-border transfers. Have your privacy owner or counsel map those facts before launch; do not present Gmail policy as a legal checklist.
Quick Recap
Operational checklist for launch
- Every sending system and envelope domain is inventoried.
- There is one SPF policy per domain, containing only authorized infrastructure.
- Provider-managed or application-managed DKIM ownership is explicit, and selectors and keys are documented.
- DMARC reports reach a monitored destination and all legitimate sources are aligned.
- Custom MAIL FROM subdomains have the provider-required MX and SPF records and are not used as normal mail domains.
- Tests from each Node.js path show SPF pass, DKIM pass and DMARC pass with alignment.
- Gmail volume, TLS, DNS, formatting, spam-rate and unsubscribe requirements are checked against Google’s current pages.
- Legal, privacy and data-transfer decisions are documented separately from DNS authentication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
