How to Set Up SPF, DKIM, and DMARC: The Complete Guide

Email remains the lifeblood of business communication, but deliverability standards have changed. Starting in 2024, Google and Yahoo enforce strict email authentication for all domain senders. If your DNS records lack SPF, DKIM, and DMARC authentication, your emails will be flagged as spam or rejected.

Here is the complete guide to setting up these three critical email protocols.

The Three Pillars of Email Authentication

Think of these protocols as digital verification cards for your domain name:

1. SPF: Specifies which mail servers are allowed to send mail on your behalf.
2. DKIM: Adds a digital signature to emails, proving they weren’t altered in transit.
3. DMARC: Tells receiving servers what to do when emails fail SPF or DKIM checks.

Part 1: How to Set Up SPF (Sender Policy Framework)

SPF is configured as a TXT record inside your domain registrar (GoDaddy, Cloudflare, etc.).

Step 1: List all your email senders

Compile a list of every platform that sends emails using your domain:

• Your main mailbox (e.g. Google Workspace, Microsoft 365)
• Email marketing platforms (e.g. Mailchimp, ActiveCampaign, ConvertKit)
• Transactional email senders (e.g. SendGrid, Mailgun, Postmark)

Step 2: Merge senders into a single TXT record

You can only have one SPF record on a domain. Having multiple will cause authentication to fail.

• Google Workspace uses: include:_spf.google.com
• Microsoft 365 uses: include:spf.protection.outlook.com
• Mailchimp uses: include:servers.mcsv.net

To combine Google and Mailchimp, write:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Add the new TXT record:

• Type: TXT
• Host/Name: @ (representing your root domain)
• Value: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Part 2: How to Set Up DKIM (DomainKeys Identified Mail)

DKIM uses public-key cryptography to sign emails.

Step 1: Generate the DKIM key

Log in to your email admin dashboard.

• Google Workspace: Go to Apps > Google Workspace > Gmail > Authenticate Email. Click Generate New Record.
• Microsoft 365: Go to Security & Compliance Center > Threat Management > Policy > DKIM. Enable keys for your domain.

Step 2: Add the TXT record in your DNS settings

Copy the host name and key value generated by your provider.

• Type: TXT
• Host/Name: google._domainkey (or the specific selector provided by your host)
• Value: Paste the long string of characters starting with v=DKIM1; k=rsa; p=...

Step 3: Turn on authentication

Once the DNS record propagates (typically 1 hour), return to your email administrator panel and click Start Authentication.

Part 3: How to Set Up DMARC

DMARC coordinates SPF and DKIM authentication. It is also added as a TXT record.

Step 1: Choose a DMARC policy

• p=none: Monitor mode. Tells recipient servers to deliver mail even if SPF/DKIM checks fail. Safe for beginners.
• p=quarantine: Tells servers to place failing emails in the spam/junk folder.
• p=reject: Tells servers to block failing emails completely. High security.

Step 2: Add the DMARC TXT record

• Type: TXT
• Host/Name: _dmarc (must include the underscore)
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Replace dmarc-reports@yourdomain.com with a real mailbox. You will receive XML compliance reports detailing what servers are sending mail on your behalf.

Testing Your Authentication Setup

Once configured, send an email to a test account or run a diagnostics check:

• MXToolbox SuperTool: Search for your domain and verify that SPF, DKIM, and DMARC are fully active.
• Inspect Email Headers: Open a test email in Gmail, click the three vertical dots next to ‘Reply’, select ‘Show Original’, and check for PASS statuses on SPF, DKIM, and DMARC.

If you are experiencing persistent issues with emails landing in spam or DNS configuration errors, read our detailed SPF & DKIM Email Fix guide or hire a verified technician to resolve it.