How to set up SPF, DKIM and DMARC for your domain
8 min read
SPF, DKIM and DMARC are DNS-based standards that let receiving mail servers check that email claiming to come from your domain is authorised. SPF lists which servers may send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and where to send reports. Gmail and Yahoo now require authentication from senders, so this is a baseline, not an optional extra.
SPF: who may send
An SPF record is a TXT record on your domain that lists the servers and services allowed to send mail using it. Receivers compare the sending server against that list.
Keep a single SPF record per domain, include only the services you actually use, and stay within SPF's limit of ten DNS lookups. Your email service provider documents the include value it needs.
DKIM: a signature on every message
DKIM signs each outgoing message with a private key held by your sending service. The matching public key is published in DNS under a selector, so receivers can verify that the message was not altered and was signed for your domain.
Most email service providers generate the DKIM keys and give you the DNS records to publish. Signing with your own domain, rather than the provider's shared domain, is what helps your domain build its own reputation.
DMARC: policy and reporting
DMARC ties SPF and DKIM to the domain in the visible From address, a concept called alignment. A DMARC record states a policy (none, quarantine or reject) and an address for aggregate reports.
- Start with p=none and a reporting address to see who sends as your domain
- Fix any legitimate senders that fail alignment
- Move gradually to quarantine and then reject once reports are clean
- Keep monitoring reports after every change to your sending services
Checking your work
After publishing records, send a message to a mailbox you own and inspect the message headers for SPF, DKIM and DMARC results. Viewing your own test messages in Gmail, Outlook and Yahoo seed mailboxes is a practical way to confirm everything passes before a campaign goes out.
Step by step
- 1List your senders. Write down every service that sends mail as your domain, such as your ESP, help desk and office mail.
- 2Publish SPF. Create one SPF TXT record that includes each legitimate sender and ends with an appropriate all mechanism.
- 3Enable DKIM. Generate DKIM keys in each sending service and publish the public key records it provides.
- 4Add DMARC at p=none. Publish a DMARC record with policy none and a reporting address, for example using a DMARC record generator.
- 5Review reports and tighten. Fix failing senders from the aggregate reports, then step the policy up to quarantine and reject.
Frequently asked questions
Do I need all three records?
In practice, yes. Gmail and Yahoo expect SPF and DKIM for senders, and require a DMARC record for bulk senders. Together they make spoofing harder and support your reputation.
Will a reject policy stop my own mail?
It can if a legitimate service is not aligned. That is why you start at p=none, read the reports and fix every legitimate sender before tightening the policy.
Can I have more than one SPF record?
No. Multiple SPF records on the same domain cause SPF to fail. Combine all senders into a single record.
Also useful: Free email tools · Documentation