SPF, DKIM and DMARC Setup: Step-by-Step for Any Domain

Set up SPF first (a TXT record listing who may send as your domain), then DKIM (a public key your provider signs mail against), then DMARC (a TXT record at _dmarc that tells receivers what to do when checks fail and where to send reports). Start DMARC at p=none, verify with a test message, and tighten later.

What the three records do

Record	Where it lives	Question it answers
SPF	TXT record on the domain	Is this server allowed to send for this domain?
DKIM	TXT (or CNAME) at selector._domainkey.domain	Was this message signed by the domain and left unmodified?
DMARC	TXT at _dmarc.domain	If SPF and DKIM do not align with the From domain, what should the receiver do, and who gets reports?

These are independent mechanisms that DMARC ties together. DMARC passes when either SPF or DKIM passes and the domain that passed matches the visible From domain. That matching is called alignment.

Before you touch DNS: inventory your senders

Most failures come from a forgotten sender, not a bad record. List every system that sends mail with your domain in the From address: your mailbox provider (Google Workspace, Microsoft 365), your marketing platform, your CRM, support desk, billing tool, a website contact form, any cold-outreach platform. Each one needs to be covered by SPF or, better, DKIM on your domain.

If you run cold outreach, do it from a separate domain; our article on sending domains versus subdomains explains why.

Step 1: SPF

SPF is a single TXT record at the domain root. BusinessMCP’s guide gives this example:

v=spf1 include:_spf.google.com include:amazonses.com ~all

• v=spf1 marks it as SPF.
• Each include: pulls in the sending ranges of a service you use.
• ~all is a softfail for anything not listed; -all is a hard fail.

Rules that matter: publish one SPF record only, because a second v=spf1 record causes a permanent error; and stay within 10 DNS lookups, which RFC 7208 sets as the limit. Each include, a, mx and redirect counts. See SPF permerror and the lookup limit if you hit it.

Step 2: DKIM

DKIM publishes a public key; your sending service signs outgoing messages with the matching private key.

1. In your provider’s admin panel, find the DKIM or “domain authentication” section.
2. Generate a key. 2048-bit is the common default; BusinessMCP’s guide notes Gmail requires at least 1024-bit for personal accounts.
3. The provider will give you either a TXT value or CNAME records to add at selector._domainkey.yourdomain.com. The selector name comes from the provider.
4. Add the records in your DNS host, then click “verify” or “start signing” in the provider.

Repeat for every sending service. If a checker later says DKIM is missing, confirm the selector first; see DKIM selector not found.

Key takeaway: DKIM on your own domain is the most reliable way to pass DMARC alignment, because it survives forwarding better than SPF, which breaks when a message is forwarded through a different server.

Step 3: DMARC

Publish a TXT record at _dmarc.yourdomain.com. The starter example from BusinessMCP’s guide:

v=DMARC1; p=none; rua=mailto:[email protected]

• p= sets the policy: none, quarantine or reject.
• rua= is the address for aggregate reports.
• sp= (subdomain policy) and pct= (percentage of mail the policy applies to) are optional.

Google and Yahoo both accept p=none as meeting their DMARC requirement for bulk senders, according to BusinessMCP’s summary of the rules; confirm on Google’s sender guidelines. Use a mailbox someone reads for rua, or a reporting service, because raw XML reports are hard to parse by eye.

Step 4: verify

1. Run the domain through BusinessMCP’s free email deliverability checker, which grades MX, SPF, DKIM and DMARC and shows the exact record to paste when one is missing.
2. Wait for DNS to propagate; changes can take up to about an hour depending on TTL.
3. Send a real test from each service and read the headers for spf=pass, dkim=pass, dmarc=pass. The email deliverability test article explains how.
4. Confirm the domain next to each pass is yours.

Step 5: move DMARC toward enforcement

BusinessMCP’s rollout sequence is a sound default:

1. Publish p=none with a rua address.
2. Monitor reports for two to four weeks.
3. Fix legitimate sources that fail by adding SPF includes or enabling DKIM.
4. Move to p=quarantine, optionally starting with pct=25.
5. Monitor for another two to four weeks.
6. Move to p=reject.

Enforcement protects your domain from spoofing, but it can block your own mail if a sender was missed, so the monitoring period is not optional. The trade-offs are covered in DMARC none, quarantine or reject.

Common setup mistakes

• Adding SPF in your email app instead of DNS. Records live in the DNS zone.
• Publishing a second SPF record for a new tool rather than editing the existing one.
• Copying records with extra quotes or line breaks. Some DNS hosts add quotes automatically; paste only the value.
• Forgetting subdomains. Mail sent from news.yourdomain.com needs its own coverage or an sp= policy.
• Leaving rua pointed at a mailbox that does not exist.

For the longer reference version, BusinessMCP’s SPF, DKIM and DMARC guide covers the same ground, including its list of common failures. If you are sending at bulk volume, check the Gmail and Yahoo requirements too, since DMARC is mandatory there. Syntax and limits are defined in the RFCs listed above; defer to them over any summary, including this one.

A short pre-flight list

• One SPF record, under 10 lookups.
• DKIM signing on for every sender, with your domain in d=.
• DMARC published with a working rua.
• Test message headers pass and align.
• Calendar reminder to review DMARC reports monthly.

Setup notes by sending platform type

The steps are the same, but the screens differ. A few patterns help you know what to expect.

Platform type	SPF	DKIM	Watch for
Mailbox suite (Google Workspace, Microsoft 365)	Add the suite’s include	Generate key in admin console, publish record	Enabling signing after publishing
Marketing platform	Often optional if DKIM aligns	CNAMEs for your domain	Default signing with vendor’s own domain
Transactional API	Include or dedicated IP	Domain verification with DKIM records	Separate subdomain for sending
Website forms and plugins	Usually route via an SMTP service	Same as that service	Mail sent from the web server itself, unsigned
Cold outreach platform	Covered by the mailbox provider	Covered by the mailbox provider	Use a separate domain entirely

Testing each sender, not just the domain

A domain-level grade shows what is published. It does not show which of your senders is using it. Send one test from every service and read its headers. A sender missing from your records is the most common surprise when DMARC reports first arrive. Our deliverability test walkthrough explains the header check.

Where to go next

BusinessMCP’s Google and Yahoo requirements guide explains which of these records the big providers now mandate, and the bulk sender summary on this site translates it into a checklist. If you get stuck on one record, the focused articles on the SPF lookup limit and DKIM selectors cover the two most frequent failures.