SPF, DKIM and DMARC: what they do and how to set them up
These three DNS records prove that the mail you send really came from you. Without them your message is filtered before anyone reads a word. This guide explains what each one does and exactly what to paste into your DNS panel.
Email was designed in the 1980s on the assumption that nobody would lie. That is why you can write anything you like in the “from” field — the protocol does not check it. SPF, DKIM and DMARC are three layers added later to close that gap.
Together they answer one question: did this message really leave this domain? When the answer is “unknown”, the receiving provider takes the safe route and files it as spam.
SPF — which servers may send for you
SPF (Sender Policy Framework) is the list of servers authorised to send mail on behalf of your domain. When a message arrives the receiving server checks whether that IP is on the list.
What the record looks like
You add a TXT record on the domain itself (host `@`):
v=spf1 include:_spf.yourprovider.com ~all
- `v=spf1` — the version; every SPF record starts this way.
- `include:` — the provider you are authorising. Google Workspace, Microsoft 365, Hostinger and others each publish their own value.
- `~all` — treat mail from servers not on the list as suspicious. `-all` is stricter (reject outright); `+all` makes the record meaningless and should never be used.
DKIM — the message signature
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing message. The public key that verifies it lives in your DNS. The receiving server compares the two; if they match, the message is proven both to come from you and to be unmodified in transit.
The record sits under a selector your provider gives you:
selector._domainkey.yourdomain.com
Its value is a long key string (`v=DKIM1; k=rsa; p=MIIBIjANBgkq...`). Do not type it by hand — copy and paste. One missing character invalidates the whole signature, and nothing anywhere reports an error.
DMARC — what to do when verification fails
SPF and DKIM answer “is this genuine”. DMARC answers “what should I do if it is not”. It also gives you reports about mail sent in your domain’s name.
Add a TXT record named `_dmarc`:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
| Policy | Effect | When to use |
|---|---|---|
| p=none | Nothing; reports only | At first setup — the correct starting point |
| p=quarantine | Unverified mail goes to spam | After a few weeks of clean reports |
| p=reject | Unverified mail is rejected outright | Once the setup is fully settled |
Do not start at `p=reject`. If some forgotten system — an invoicing tool, a form plugin, a CRM — sends from your domain, that mail disappears completely and silently. Watch the reports on `p=none` for a few weeks, then tighten in steps.
Setting it up
- 1Open the DNS Zone section in your domain registrar’s panel.
- 2Take the SPF `include:` value from your email provider and add it as a single TXT record on `@`.
- 3Enable DKIM in your email provider’s panel; it gives you a selector name and a long key. Add it as TXT.
- 4Add a TXT record named `_dmarc`, starting with `p=none`.
- 5Wait for propagation and verify by sending a real message.
The “I added it but it still says missing” trap
Checking tools may keep reporting a record as missing even after you have added it correctly. The cause is usually not a mistake but negative caching.
When a DNS record is queried and not found, the “not found” answer is itself cached (RFC 2308). How long depends on the domain’s SOA record, and with many registrars that is one hour. So if you checked once before adding the record, you will keep getting “missing” for an hour afterwards.
Checklist after setup
- Is there exactly one SPF record on the domain?
- Does SPF end in `~all` rather than `-all`? (`~all` is safer to start with.)
- Is the DKIM key complete — nothing truncated at the end?
- Does DMARC start at `p=none`, and does the report address work?
- Do the headers of a real message to a real recipient show `dkim=pass` and `spf=pass`?
The last one is easy to check in Gmail: open the message, choose Show original from the three-dot menu, and read the summary at the top. All three should say PASS.
If the records are complete and your mail still lands in spam, the problem is reputation rather than identity — see the other eleven causes in why your emails land in spam.
Frequently asked
How long does a DNS change take to apply?
Usually between a few minutes and a few hours, depending on the record’s TTL. But the delay you experience is often not propagation — it is a previously cached “not found” answer. Querying over DNS-over-HTTPS bypasses that.
What happens if only one of the three is missing?
Without SPF the sending server’s authorisation cannot be checked. Without DKIM there is no proof the message was not altered, and verification breaks easily on forwarded mail. Without DMARC there is no instruction for what to do when the first two fail, and your domain is unprotected against being spoofed.
Do subdomains need their own records?
For SPF and DKIM, yes — if you send from `mail.yourcompany.com` that subdomain needs its own records. DMARC is inherited from the parent domain; the `sp=` tag lets you set a separate policy for subdomains.
Do I have to read the DMARC reports?
Not strictly, but the first few weeks are genuinely useful: they show which systems send mail using your domain. Most companies discover a forgotten service this way. The reports arrive as XML and free tools will render them readable.
You do not have to set this up yourself
Tell us your industry and the city you sell to. We find the companies and their business email addresses, and send from your own domain at a pace that keeps you out of spam.