SPF, DKIM and DMARC explained: step-by-step setup
What SPF, DKIM and DMARC are, why email campaigns need them and how to set them up in your domain's DNS. With example records for Google Workspace and Microsoft 365 and the mistakes to avoid.
SPF, DKIM and DMARC are three records in your domain's DNS that prove to mail providers an email really comes from you. Without them emails land in spam more often, and since 2024 Gmail and Yahoo require authentication from every sender. The setup takes 15 to 30 minutes.
In plain words
- SPF is a list of who's allowed. You record in DNS which servers may send mail for your domain.
- DKIM is a seal on the envelope. Every email is signed with a key, and the recipient's mail provider checks the signature against your DNS.
- DMARC is the instruction for forgeries. It says what to do with an email that fails SPF or DKIM: let it through, put it in spam or reject it.
Where to set it up
In your domain's DNS settings: at your registrar (Namecheap, GoDaddy, Cloudflare and so on) or wherever you moved your DNS. Find "DNS records" and add TXT records (DKIM sometimes uses CNAME).
Step 1. SPF
Create one TXT record for the root of the domain (@):
| You use | Record value |
|---|---|
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com ~all |
| Google Workspace + Brevo | v=spf1 include:_spf.google.com include:spf.brevo.com ~all |
The ~all part means "treat other senders as suspicious". The key rule: a domain must have only one SPF record.
Step 2. DKIM
Your mail service generates the DKIM key:
- Google Workspace: Admin Console → Apps → Gmail → Authenticate email → Generate new record. You get a TXT record named
google._domainkey. - Microsoft 365: Defender → Email authentication → DKIM. There are two CNAME records.
- Brevo, Mailgun and others: in the service's domain settings.
Add the record to DNS, then click "Verify" or "Start authentication" in the service.
Step 3. DMARC
Create a TXT record named _dmarc:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=noneblocks nothing and only collects reports. Start here.rua=is where mail providers send the reports.
After a few weeks, once the reports show all your legitimate email passes, change it to p=quarantine.
How to check
- Wait 15–60 minutes for the records to propagate.
- Send an email to the address from mail-tester.com.
- Or send one to your own Gmail → three dots → "Show original". Look for
SPF: PASS,DKIM: PASS,DMARC: PASS.
Common mistakes
- Two SPF records. Then neither works. Merge them into one.
- Forgetting to add your sending service to SPF. Its emails fail the check.
- Adding DKIM to DNS but not enabling it in the service. Emails don't get signed.
- Going straight to
p=reject. If one service is misconfigured, its emails simply disappear.
After this setup our own emails scored 9.2 out of 10 on mail-tester. Other reasons emails go to spam, and a 30-minute checklist, are in why emails go to spam.
FAQ
How many SPF records can a domain have?
Only one. If you use several services, combine them in one record: v=spf1 include:_spf.google.com include:spf.brevo.com ~all.
Which DMARC policy should I start with?
p=none: nothing is blocked, but you get reports. Once you're sure all your services pass, move to p=quarantine and later to p=reject.
How do I check the records work?
Send an email to mail-tester.com, or to your own Gmail and open "Show original": it shows the SPF, DKIM and DMARC result (PASS or FAIL).