Skip to main content

How to set up SPF, DKIM and DMARC (the 20-minute guide)

If your email lands in spam, or someone is spoofing your domain, the fix is almost always the same three DNS records: SPF, DKIM and DMARC. This guide explains what each one does and gives you copy-paste examples.

What each record does

  • SPF lists the servers allowed to send email for your domain.

  • DKIM adds a cryptographic signature so receivers can verify a message was not altered.

  • DMARC tells receivers what to do when SPF or DKIM fail, and sends you reports.

1. SPF — one TXT record

There must be exactly one SPF record per domain. Keep it short; each lookup costs a little budget.

text
yourdomain.com.  TXT  "v=spf1 include:_spf.yourprovider.com -all"

2. DKIM — a TXT record per selector

Your mail provider gives you a selector and a public key. Add them as a TXT record, then enable signing.

text
selector._domainkey.yourdomain.com.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0G..."

3. DMARC — start in monitor mode

Begin with p=none so you can watch reports without blocking legitimate mail, then tighten to quarantine and reject.

text
_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Test before you send

After adding the records, run them through our free SPF / DKIM / DMARC checker to confirm they resolve and are valid. Then send a test message to a Gmail or Outlook account and inspect the authentication results in the headers.

Common mistakes

  • More than one SPF record (breaks validation).

  • SPF lookups exceeding the 10-lookup limit.

  • Forgetting to actually enable DKIM signing at the mail provider.

  • Jumping straight to p=reject and blocking your own mail.

Once these records are healthy, your legitimate mail is far more likely to reach the inbox and spoofed mail is far more likely to be rejected.

← Back to all posts