SPF, DKIM and DMARC Setup Guide

Quick answer: SPF lists the servers allowed to send mail for your domain, DKIM signs each message with a key published in DNS, and DMARC tells receivers what to do when a message fails both checks for your domain. Set up SPF and DKIM first, publish DMARC with p=none, read the reports, then move step by step to p=quarantine and p=reject.

What SPF, DKIM and DMARC each do

Alignment is the key idea. SPF and DKIM can pass for your email provider's domain while the From header shows yours. DMARC passes only when at least one of them passes for a domain that matches the From domain. In the default relaxed mode, a subdomain such as bounce.example.com aligns with example.com; strict mode (aspf=s, adkim=s) requires an exact match.

Set up SPF and DKIM first

SPF. Publish exactly one TXT record at the domain that starts with v=spf1, lists every service that sends as you, and ends with an all mechanism. Two separate SPF records cause a permanent error under RFC 7208. Keep the record within the limit of 10 DNS-querying terms (include, a, mx, ptr, exists and redirect); going over it also causes a permanent error. End with ~all (soft fail) while you test and -all (fail) when the list is complete. Never use +all, which authorizes every server on the internet.

DKIM. Turn on signing in each sending service and publish the public key it gives you, usually as a TXT record or a CNAME at selector._domainkey.example.com. The selector lets you run several keys at once, one per service. RFC 8301 requires RSA keys of at least 1024 bits and recommends 2048 bits, so choose 2048 where the service offers it.

Then send a test message to a mailbox you control: its Authentication-Results header should show spf=pass and dkim=pass.

Publish DMARC and move to enforcement

A DMARC record is a TXT record at _dmarc.example.com. It must start with v=DMARC1, and the p tag is required. The tags you will use most:

• p: the policy, none, quarantine or reject.
• rua: where receivers send daily aggregate reports, for example mailto:dmarc@example.com.
• sp: a separate policy for subdomains; without it, subdomains inherit p.
• pct: the percentage of failing mail the policy applies to; the default is 100.
• adkim and aspf: r (relaxed, the default) or s (strict) alignment.

A safe rollout is: start with p=none and a rua address, read reports for a few weeks, fix every legitimate source that fails, then move to p=quarantine and finally p=reject.

Since February 2024, Google requires senders of around 5,000 or more messages a day to personal Gmail accounts to set up SPF and DKIM, publish a DMARC record (p=none is accepted) and align the From domain with SPF or DKIM. Yahoo introduced similar rules for bulk senders. Check both providers' current sender guidelines, because the details can change.

Worked example: one domain, two senders

Suppose example.com uses Google Workspace for staff mail and a newsletter service that sends from news.example.com. The records could look like this:

example.com.                    TXT   "v=spf1 include:_spf.google.com ~all"
news.example.com.               TXT   "v=spf1 include:spf.newsletter-provider.example ~all"
google._domainkey.example.com.  TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc.example.com.             TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Workspace mail passes SPF and DKIM for example.com. Newsletter mail sent with a Return-Path at news.example.com passes SPF and still aligns with a From address at example.com under relaxed alignment. Once the reports show both sources passing, change the DMARC record to p=quarantine, then p=reject.

At the first stage, the DMARC Checker shows Policy: none, Subdomain policy: inherits main policy, Percentage: 100% and a note that the policy is monitoring only.

How to use the free DMARC Checker

1. Type the bare domain, such as example.com, into the Domain name field. Do not enter a URL or an email address; the tool asks for a valid domain if you do.
2. Select Check DMARC record. Your browser queries the TXT records at _dmarc. plus your domain through Cloudflare's public DNS-over-HTTPS resolver.
3. If you see "No DMARC record found", add a TXT record at the name the tool shows.
4. Otherwise, read the published record and the four values below it: Policy, Subdomain policy, Percentage and Aggregate reports.
5. Review the Recommendations list. It flags a missing p tag, a monitoring-only p=none policy, a missing rua address and a pct value that is not a whole number from 0 to 100.
6. After changing DNS, run the check again. A cached old answer can persist until the record's TTL expires.

The checker reads only the DMARC record, not SPF or DKIM. If you check a subdomain, it looks only at that subdomain's _dmarc name; receivers fall back to the parent domain's record, so "No DMARC record found" for a subdomain does not mean it is unprotected.

Common mistakes

• Publishing two SPF records instead of merging them into one.
• Exceeding the 10-lookup SPF limit by stacking include terms.
• Placing the DMARC record at example.com instead of _dmarc.example.com.
• Jumping straight to p=reject before every sending service passes aligned SPF or DKIM.
• Leaving p=none in place for good; it gives visibility, not protection.