How to Set Up SPF, DKIM, and DMARC Correctly

SPF, DKIM, and DMARC are the three records that decide whether the world's mailbox providers trust your email. Get them right and your mail reaches the inbox; get them wrong — or skip them — and you fight the spam folder forever. As of 2024, Gmail and Yahoo requireall three for bulk senders, so this is no longer optional. Here's how each works and how to set them up correctly, in the right order.

The 30-second overview

• SPF says which servers may send mail for your domain.
• DKIM adds a tamper-proof signatureproving the message wasn't altered.
• DMARC ties them together and tells receivers what to do when a message fails — and sends you reports.

Set them up in that order, because DMARC depends on SPF and DKIM being in place first.

Step 1: Publish a valid SPF record

SPF is a single TXT record listing every service allowed to send for your domain. A typical record looks like v=spf1 include:_spf.google.com ~all. The key rules:

• Publish exactly one SPF record — multiple records invalidate each other.
• Include every sender — your mail host, marketing platform, CRM, and so on.
• End with ~all (softfail) or -all (hardfail). Never use +all, which lets anyone send as you.
• Stay under the 10 DNS-lookup limit. This is the single most common silent SPF failure: every include counts, nested includes add up, and going over makes SPF fail with a permerror even though the record looks fine.

After publishing, validate it with an SPF checker that counts lookups — not just one that confirms the record exists.

Step 2: Enable DKIM signing

DKIM adds a digital signature to every message, using a private key held by your mail server and a public key you publish in DNS. Receivers use the public key to confirm the message is authentic and unmodified. You don't write DKIM by hand — you enable it in your mail provider (Google Workspace, Microsoft 365, your ESP), which gives you a selector and a DNS record to publish. Once live, confirm it with a DKIM checker.

Step 3: Add a DMARC record — and start safe

DMARC lives at _dmarc.yourdomain.com and looks like v=DMARC1; p=none; rua=mailto:reports@yourdomain.com. The p= tag is the policy, and you should raise it gradually:

1. p=none — monitor only. Nothing changes for your mail, but you start receiving reports showing what passes and fails. Stay here until the reports look clean.
2. p=quarantine— failing mail goes to spam. Move here once you're confident legitimate mail passes.
3. p=reject — failing mail is rejected outright. This is full protection against spoofing, and the goal.

Always include a ruaaddress so you receive aggregate reports — without them you're flying blind. Never jump straight to p=reject, or you risk blocking your own mail. Verify the record with a DMARC checker.

Step 4 (optional but recommended): MTA-STS

Once the big three are in place, MTA-STS enforces TLS encryption for mail sent to you, closing off downgrade attacks. It's a strong finishing touch for a fully hardened setup.

Common mistakes to avoid

• Publishing two SPF records (breaks SPF entirely).
• Exceeding the 10-lookup limit (silent failure).
• Leaving DMARC at p=none forever — it never actually protects you.
• Forgetting the rua address, so you never see what's failing.
• Adding a new sending service without updating SPF.

If your mail is already landing in spam, this pairs well with why your emails go to spam and how to fix it.

Frequently asked questions