How to Set Up SPF, DKIM and DMARC for Email
To authenticate email, list every service that sends mail as your domain, publish one SPF TXT record that authorizes them, turn on DKIM signing in each service and add its DNS keys, then publish a DMARC record starting at p=none with a reporting address. Read the reports for a few weeks, fix any legitimate sender that fails, and tighten to quarantine and then reject. Gmail and Yahoo require all three for anyone sending more than 5,000 messages a day to their users.
- SPF lists the servers allowed to send for your domain; DKIM signs each message; DMARC tells receivers what to do when both fail to align.
- A domain must have only one SPF record, and SPF evaluation fails if it needs more than 10 DNS lookups.
- DMARC passes only when SPF or DKIM passes for a domain that aligns with the visible From address.
- Gmail and Yahoo require SPF, DKIM, DMARC and one-click unsubscribe for bulk senders, and Microsoft added similar rules for Outlook.com.
- In May 2026 the IETF published RFC 9989, which replaces RFC 7489 as the DMARC standard.
The Steps
- Inventory every sending serviceList everything that sends email using your domain: Google Workspace or Microsoft 365, your CRM, email marketing platform, invoicing, help desk, website forms and booking tools.
- Publish a single SPF recordCreate one TXT record at the root domain starting with v=spf1, add an include for each service's documented SPF value, and end with ~all or -all. Merge any duplicate SPF records.
- Check the SPF lookup countEach include, a, mx and redirect costs DNS lookups, and SPF fails beyond 10. Remove services you no longer use or move bulk senders to a subdomain with its own record.
- Enable DKIM in each serviceIn each sending platform, turn on DKIM for your domain and add the CNAME or TXT records it provides. Use 2048-bit keys where offered and confirm each shows as verified.
- Publish DMARC at p=noneAdd a TXT record at _dmarc.yourdomain.com such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com so you start receiving daily aggregate reports without changing how any of your mail is delivered.
- Read reports and fix failuresUse a DMARC report viewer to see which sources send as your domain and whether they pass aligned SPF or DKIM. Fix legitimate senders and identify any spoofing.
- Move to quarantine, then rejectOnce legitimate mail passes consistently for several weeks, change the policy to p=quarantine, monitor again, then move to p=reject to stop spoofed mail reaching inboxes.
- Meet bulk sender requirementsFor marketing email, add one-click unsubscribe headers and a visible unsubscribe link, honor opt-outs within two days, and keep spam complaints well below 0.3% in Google Postmaster Tools.
What SPF, DKIM and DMARC Each Do
Email was designed without any way to prove who sent a message, which is why anyone can put your domain in the From line of a phishing email. Three DNS-based standards fix this together:
- SPF (Sender Policy Framework, RFC 7208) is a TXT record listing which servers may send mail using your domain in the envelope sender address.
- DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to each message. Receivers check it against a public key published in your DNS, which proves the message was authorized and not altered.
- DMARC (now RFC 9989, which replaced RFC 7489 in May 2026) checks that SPF or DKIM passed for a domain that aligns with the From address people see, tells receivers what to do if not (nothing, spam folder or reject), and sends you reports.
Alignment is the part people miss. Your CRM might pass SPF using its own domain, but if that domain does not match yours, DMARC still fails. The usual fix is enabling DKIM with your domain inside that service.
What Gmail, Yahoo and Outlook Require
Since February 2024, Google requires all senders to Gmail accounts to use SPF or DKIM, have valid forward and reverse DNS, use TLS and keep the spam rate reported in Postmaster Tools below 0.3%. Bulk senders, defined as those sending more than 5,000 messages a day to Gmail accounts, must also have SPF and DKIM, publish a DMARC policy (p=none is acceptable), align the From domain with SPF or DKIM, and support one-click unsubscribe for marketing mail. Google advises staying below 0.1% spam rate and never reaching 0.3%.
Yahoo's requirements are similar and add that unsubscribes must be honored within two days. Microsoft introduced comparable SPF, DKIM and DMARC requirements in 2025 for domains sending high volumes to Outlook.com, Hotmail and Live addresses. Even if you are well below 5,000 a day, meeting the bulk sender standard is the safest baseline, because volume spikes from a single campaign count.
Getting SPF Right
A typical SPF record looks like v=spf1 include:_spf.google.com include:sendgrid.net ~all. The rules that cause most failures:
- One record only. Two TXT records starting with
v=spf1produce an error, and receivers treat SPF as broken. Merge them. - Ten lookups maximum. RFC 7208 limits SPF evaluation to 10 DNS lookups, and nested includes count. Too many services in one record silently breaks it. Remove old vendors, or send marketing mail from a subdomain such as
mail.yourdomain.comwith its own record. - Ending.
~all(soft fail) is the common, forgiving choice;-all(fail) is stricter. With DMARC enforcing, the difference matters less than getting the includes right.
Rolling Out DMARC Without Losing Mail
Start with p=none and a rua address. Aggregate reports arrive daily from major mailbox providers as XML files, which are unreadable by hand, so use a DMARC reporting service or tool to summarize them. Over two to four weeks you will see every source sending as your domain: your own platforms, forgotten tools (an old website plugin, a payroll system) and, often, spoofers.
Fix each legitimate source by enabling DKIM with your domain or adding it to SPF. When nearly all legitimate mail passes, move to p=quarantine, watch for a few weeks, then p=reject. RFC 9989 keeps the v=DMARC1 version tag but removes the old pct percentage tag; it adds a t flag for test mode. Check that your DNS host and reporting tool handle current syntax.
Enforcement matters beyond deliverability. A domain at p=reject is much harder to impersonate in invoice and wire-fraud emails aimed at your customers and vendors. That is also why authentication is a standard item in email marketing setups and security reviews.
Beyond Authentication: Staying Out of Spam
Authentication proves the mail is yours; it does not make people want it. Mailbox providers also weigh complaints, engagement and list quality. Send only to people who opted in, remove addresses that bounce, make unsubscribing easy and honor it quickly, and keep marketing and transactional mail on separate subdomains so a campaign problem does not delay invoices. Register your domain in Google Postmaster Tools to watch spam rate and authentication results over time. For choosing between channels, see email vs SMS marketing.
Sources and Further Reading
We link to the primary documentation so you can verify the details yourself.
- RFC 7208: Sender Policy Framework (SPF), IETF
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, IETF
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), RFC Editor
- Email sender guidelines, Google Workspace Admin Help
- Sender best practices, Yahoo
- Outlook's new requirements for high-volume senders, Microsoft Tech Community
Related Questions
Should my SPF record end in ~all or -all?
Either works once DMARC is in place, because DMARC decides the outcome based on alignment. Many administrators use ~all to avoid rejecting mail from a forgotten legitimate sender, and rely on DMARC at quarantine or reject for protection against spoofing.
How long should I stay at p=none?
Long enough to see every legitimate sender pass, typically two to six weeks depending on how many tools send as your domain and how often some of them send. Monthly billing or payroll systems may take a full cycle to show up in reports.
Do I need DMARC if I only send a few emails a day?
Yes. Even if you are not a bulk sender, DMARC with reporting shows who is sending as your domain, and an enforced policy makes it much harder for criminals to impersonate you in phishing or invoice fraud aimed at your customers.
Does DMARC work with email forwarding?
Forwarding often breaks SPF because the forwarding server is not in your record. DKIM signatures usually survive forwarding if the message is not modified, which is why having DKIM aligned with your domain is important before moving to enforcement.