SPF, DKIM and DMARC set-up, step by step.

What SPF, DKIM and DMARC each do

Email was built without a way to prove who sent a message. Anyone can type your address into the “From” line. SPF, DKIM and DMARC fix this. Each one answers a different question, and they work as a team.

One more word you will see is alignment. DMARC does not only ask whether SPF or DKIM passed. It also asks whether the domain they checked matches the domain people see in the “From” line. A message passes DMARC when at least one of the two passes and matches. Step 4 explains this again, because it is a place where set-ups can go wrong.

Why it matters now

Gmail, Yahoo and Outlook.com have each published rules that expect proper email authentication. The points below come from their own pages (see Sources at the end).

• Google (Gmail). Every sender to Gmail needs SPF or DKIM. A sender that sends about 5,000 or more messages a day to personal Gmail accounts needs SPF, DKIM and DMARC, a “From” domain that matches, and one-click unsubscribe for marketing and subscribed mail. Google also asks all senders to keep the spam rate in Postmaster Tools under 0.10% and never to reach 0.30%. These rules took effect in February 2024. Google says it has increased enforcement since November 2025, and that mail from senders who do not follow the rules can be rejected, for a short time or for good. It also says that once you count as a bulk sender, you stay one.
• Yahoo. Yahoo’s rules for bulk senders follow the same pattern: authentication, easy unsubscribe and a low rate of spam complaints. Yahoo does not publish a number for what counts as bulk, so treat the rules as your target if you send in any real volume.
• Microsoft (Outlook.com, Hotmail and Live). From 5 May 2025, high-volume senders (more than about 5,000 emails a day to these consumer addresses) need SPF, DKIM and DMARC, with DMARC at least at p=none and matching SPF or DKIM. Mail that does not meet the rules is refused, with the error code 550 5.7.515.

If you send fewer messages, the strict rules apply to you less. But the safe standard is the same: set up all three. They make it much harder for others to fake your domain, and they give inboxes a reason to trust you. Unsubscribe links and low complaint rates matter too. Your email tool normally adds the one-click unsubscribe headers for you (the standard for this is RFC 8058).

Before you start

• A domain you own, for example yourcompany.com. You cannot do this for gmail.com or outlook.com addresses. Those domains belong to Google and Microsoft.
• Access to your DNS records. DNS is managed by the company your domain’s nameservers point to. That is not always the company you bought the domain from. If you use Cloudflare for DNS, your records are in Cloudflare.
• Admin access to your email service, such as Google Workspace, Microsoft 365, Zoho Mail or your web host’s mail.
• About one hour. Choose a quiet time, not the busiest hour for your email.
• A copy of your current records. Before you change anything, take a screenshot or copy the text of every TXT and CNAME record you already have. If something goes wrong, you can put it back.

Step 1 of 5

List every service that sends email as you

SPF and DMARC only work when your list of senders is complete. If you forget one service, its mail will fail the checks. Look in these places:

• Your mailbox service (Google Workspace, Microsoft 365, Zoho Mail or your web host).
• Your newsletter or marketing email tool.
• Your cold email or outreach tool.
• Your CRM and any sales tool that sends on your behalf.
• Invoicing, payment and booking tools.
• Your website: contact forms, order emails and plugins that send mail.
• Your help desk or support tool.
• Any server or app of your own that sends system emails.

Ask your team, look at the messages you sent in the last 30 days, and search your inbox for “on behalf of”. Your DMARC reports (Step 4) will also reveal senders you forgot. That is why we start DMARC in monitor mode.

For each sender, write down its name, what it sends, and the help page in its help centre about authenticating your domain (look for words like “SPF”, “DKIM”, “domain authentication” or “verify your domain”). That page gives you the exact values to use.

Step 2 of 5

Set up SPF

SPF is one line of text in a TXT record on your domain. It lists the services that may send email as you.

The parts of an SPF record

Examples

These are examples only. Always copy the include value from your own provider’s page, because providers change them.

Only Google Workspace sends your email:

v=spf1 include:_spf.google.com ~all

Only Microsoft 365 sends your email (this is the example on Microsoft’s own page):

v=spf1 include:spf.protection.outlook.com -all

Google Workspace plus one other sending service:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The rules that matter

1. One SPF record per domain. Two records that start with v=spf1 make SPF fail. If you need to add a service, add its include to the record you already have.
2. No more than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, and so do the includes inside other includes. Addresses written as ip4 or ip6 do not count. Go over 10 and SPF returns an error for every message. Every service you add uses some of your 10, so remove services you no longer use.
3. No more than 2 “void” lookups. A void lookup is one that returns nothing. A typo in an include value is a typical cause.
4. End with ~all or -all. Never end with +all, which lets anyone send as you. ?all protects nothing.
5. Put it on the domain you send from. If you also send from a subdomain such as news.yourdomain.com, that subdomain needs its own record.

Should I end with ~all or -all?

~all says “these are my senders, treat others with suspicion”. -all says “reject all others”. It is safe to start with ~all while you are still finding all your senders. Microsoft’s own example ends with -all. Once DMARC is enforcing (Step 4), DMARC decides what happens to mail that fails, so both endings can work. Pick one on purpose, and do not switch to -all until your list of senders is complete.

How to add it

1. Open the DNS page of your domain.
2. Look for a TXT record that already starts with v=spf1. If there is one, edit it. Do not add a second one.
3. If there is none, add a new record. Type: TXT. Name: @ (some panels want it left blank, or want your domain name). Value: the full SPF line. TTL: automatic, or one hour.
4. Save, wait a few minutes, then test (Step 5).

Step 3 of 5

Set up DKIM

DKIM uses a pair of keys. Your email service keeps the private key and uses it to sign every message. You publish the matching public key in DNS, so receivers can check the signature. If someone changes the message on the way, the check fails.

The selector is a name that tells receivers where to find the key. The key sits at [selector]._domainkey.yourdomain.com. Each service uses its own selector (Google’s default is google, and Microsoft 365 uses selector1 and selector2), so one domain can hold many DKIM records without a clash. Use 2048-bit keys when your provider offers them.

Google Workspace

1. Sign in to the Google Admin console as a super administrator.
2. Go to Apps, then Google Workspace, then Gmail, then Authenticate email.
3. Choose your domain and click Generate new record. Choose 2048-bit and keep the selector google, unless you already use that name.
4. Copy the host name and the TXT value that Google shows.
5. In your DNS panel, add a TXT record with that name and value, and save. Some panels add your domain name to the end of the name by themselves, so type only google._domainkey. If you type the full name, it can end up doubled and DKIM will fail.
6. Wait a little, go back to Authenticate email and click Start authentication.

Microsoft 365

Microsoft uses two CNAME records instead of a TXT record. In the Microsoft Defender portal, open Email authentication settings and the DKIM tab, and choose your domain. Microsoft shows two records with the host names selector1._domainkey and selector2._domainkey, each pointing to a value that belongs to your account. Copy both exactly, add them in DNS as CNAME records, wait, then turn signing on for the domain. Until you do this, your own domain is not used to sign your mail.

Every other service

Newsletter tools, CRMs, cold email tools and help desks each show their own DKIM records, often on a page called “Domain authentication”, “Sender authentication” or “Verify domain”. Add the records exactly as shown. Some use CNAME records and some use TXT records. If your DNS panel refuses a long TXT value, open the provider’s help page, because some panels need the value entered in a special way.

Step 4 of 5

Set up DMARC

DMARC sits on top of SPF and DKIM. It does two jobs: it tells receivers what to do with mail that fails, and it asks them to send you reports.

Your first record

Add a TXT record with the name _dmarc and this value (change the address to your own):

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

A domain should have only one DMARC record. For the report address, make a mailbox such as dmarc-reports@yourdomain.com. Reports arrive as small compressed XML files from large receivers such as Google, usually once a day. They are hard to read by eye, so an easy way is a report tool that turns them into a table. Choose one you trust, because the reports list your sending sources. If the report address is on a different domain, that domain has to give permission with an authorisation record, so the easiest way is to use an address on your own domain.

Alignment, in plain words

DMARC passes when SPF or DKIM passes and its domain matches the domain in your visible “From” line.

• SPF alignment. SPF checks the bounce address (also called the Return-Path), not the “From” address people see. When another company sends for you, the bounce address is often theirs. SPF passes, but it does not match you.
• DKIM alignment. The domain inside the DKIM signature has to match your “From” domain. This is what Step 3 sets up for each service.

You need only one aligned pass for each message. In practice, an aligned DKIM signature from every sending service is a reliable way to get it.

A careful rollout

The order below is VENOVIQ’s suggestion, not a rule of the standard. It protects your own email while you learn what is sending as your domain.

1. Publish p=none with rua. Leave it for at least two weeks, long enough to catch senders that only send once a month, such as invoices.
2. Read the reports. List every source. Fix the ones you own by finishing their SPF or DKIM set-up. Look closely at the ones you do not know, because they may be someone faking your domain.
3. Move to p=quarantine when your own mail passes steadily. Watch for problems for a couple of weeks.
4. Move to p=reject when everything still looks clean. Now fake mail that claims to be from you is refused by receivers that follow DMARC.

What changed in May 2026

In May 2026 the IETF published RFC 9989, the new DMARC standard, together with RFC 9990 (aggregate reports) and RFC 9991 (failure reports). They replace the old standard, RFC 7489. If your record starts with v=DMARC1, it keeps working. The tags pct, rf and ri were removed, and np, psd and t were added. A basic record only needs v, p and rua. You do not need the old pct tag in new records.

Step 5 of 5

Test that it works

1. Send a test to Gmail. Send an email from your business address to a Gmail address you control. Open it, click the three dots and choose Show original. At the top you will see SPF, DKIM and DMARC with PASS or FAIL. Look at the domain next to DKIM. It should be yours, not your provider’s.
2. Run our Domain health check. It reads your public DNS records (MX, SPF, DKIM and DMARC) and gives a grade from A to F with the exact fixes. It counts your SPF lookups and warns you about two SPF records. For DKIM it tries the usual selector names, and you can type your own. It never sends an email.
3. Try an outside check. Google’s Check MX is a free second opinion.
4. Test every sender. Send one message from each service on your list (the newsletter tool, the CRM, the invoicing tool) to Gmail and read “Show original” again. It is easy to skip this step. Then a strict policy later can block your own invoices.
5. Read your DMARC reports for a few weeks before you make the policy stricter.

Need the records written for you? The DMARC / SPF record generator lets you tick the services that send your email and gives you the SPF and DMARC lines to paste. The Email Health Score gives one number out of 100 for how much inboxes trust your email, with what to fix first.

If you send cold email

Authentication is the base. For cold outreach, a few more points matter. The first one is not about DNS at all.

• Authentication is not permission. Laws on emailing people you have never met differ by country. Our guide on finding buyers in the USA and Europe has a short comparison for the USA, the UK and Germany. This is general information, not legal advice.
• Think about a separate domain or subdomain. Microsoft recommends a subdomain for email services that are not under your direct control, such as bulk email services, so that problems there do not hurt your main domain. Some senders keep cold outreach on a separate domain for the same reason. If you do, set up SPF, DKIM and DMARC on that domain too.
• Warm up slowly. A new sending address should build volume step by step. Our free email warm-up planner gives a day-by-day plan.
• Clean the list first. Wrong addresses bounce, and bounces hurt your reputation. Check lists with the free Email Verifier.
• Make it easy to say no. Put a clear opt-out in every message. Bulk senders to Gmail and Yahoo also need the one-click unsubscribe headers, which your sending tool should add.
• Keep complaints very low. Google asks for a spam rate under 0.10%. Test a draft with our Spam Risk Test before you send.

Look-alike domains are another risk, because they can send fake mail that looks like yours. The Domain Twin Checker finds look-alike domains and shows which of them can send email.

Common mistakes

One-page checklist

• I own the domain and can edit its DNS records.
• I copied my current records before changing anything.
• I listed every service that sends email as my domain.
• I have exactly one SPF record, with 10 lookups or fewer, ending in ~all or -all.
• DKIM is on for my mailbox service, and for every other sending service.
• Gmail’s “Show original” shows SPF, DKIM and DMARC as PASS for a test from each service.
• I published a DMARC record at _dmarc with p=none and a report address I read.
• I read the reports for at least two weeks and fixed the senders that failed.
• I moved to p=quarantine, and later to p=reject, only when my own mail passed.
• I run the Domain health check again whenever I add a new sending service.