How to set up SPF, DKIM & DMARC records

Quick answer

SPF, DKIM, and DMARC are three DNS records that together tell receiving mail servers your messages are genuine. Setting them up correctly is the single biggest thing you can do to keep your mail out of spam and stop others spoofing your domain. This is a practical, step-by-step walkthrough. Once you’ve added the records, you can verify them with our Email DNS checker.

Before you start

You’ll need access to your domain’s DNS settings (at your registrar or hosting control panel) and to know who sends mail for your domain — your mailbox provider (Google Workspace, Microsoft 365, Zoho), plus any third parties that send on your behalf (a newsletter service, a CRM, your website’s contact form). Each sender needs to be accounted for in SPF and ideally DKIM.

Step 1: Add your SPF record

SPF is a single TXT record at your domain root listing who may send mail for you. Create a TXT record with the host/name set to your root (often @) and a value like v=spf1 include:_spf.google.com ~all. Replace the include: with the one your provider specifies, and add an include: for each additional sender. End with ~all (soft-fail) while testing, or -all (hard-fail) once you’re confident. Keep it to one SPF record — multiple SPF records are invalid.

Step 2: Turn on DKIM at your mail provider

DKIM is usually generated by your mailbox provider rather than written by hand. In your provider’s admin console, enable DKIM for your domain; it will give you one or more records to publish — typically a CNAME or TXT record at a name like selector._domainkey.yourdomain.com. Add exactly what it gives you, then return to the console and click “authenticate” or “start signing.” Note the selector (the part before ._domainkey) — you’ll need it to look the record up later.

Step 3: Publish a starter DMARC record

DMARC tells receivers what to do when SPF and DKIM don’t line up, and where to send reports. Create a TXT record at _dmarc.yourdomain.com with a value like v=DMARC1; p=none; rua=mailto:[email protected]. Starting at p=none with a rua= address means you collect reports without affecting delivery — this is the safe way to begin.

Step 4: Monitor reports before enforcing

Leave the policy at p=none for a couple of weeks and read the aggregate reports that arrive at your rua address. They show every source sending as your domain and whether it passes SPF/DKIM. Use them to catch legitimate senders you forgot to authorise — fix those before tightening the policy, or you’ll block your own mail.

Step 5: Tighten the policy gradually

Once reports show your real mail passing, raise enforcement in stages: move from p=none to p=quarantine (failing mail to spam), and later to p=reject (failing mail blocked). You can ramp up slowly with pct= — for example pct=25 applies the policy to a quarter of mail first. Remove pct (or set it to 100) once you’re confident.

A note on reverse DNS

SPF, DKIM, and DMARC sit on top of basic sender hygiene. If you run your own mail server, make sure its sending IP also has valid forward-confirmed reverse DNS and isn’t on a blocklist — otherwise mail can be rejected before authentication is even weighed.

Verify your records

After publishing, allow time for DNS to propagate, then run your domain through our Email DNS checker. It shows your live SPF, DMARC, and (with the selector from Step 2) DKIM records, and flags common issues like a p=none policy left in place or a missing reports address.