Key takeaways
- SPF says which servers may send for your domain, DKIM signs each message, and DMARC tells receivers what to do when those checks fail.
- A domain can have only one SPF record, and it must stay within 10 DNS lookups.
- Use 2048-bit DKIM keys and make sure the DKIM domain matches your From: address (alignment).
- Roll DMARC out in stages:
p=none→p=quarantine→p=reject, reading reports at every step.
SPF, DKIM and DMARC sound like alphabet soup, but together they answer one simple question for every mailbox provider: is this email really from who it says it's from? Without them, your newsletters look exactly like the phishing emails spammers send using your name — and since 2024, Gmail and Yahoo reject or filter bulk mail that lacks them.
This guide explains what each record does, shows real examples you can adapt, and walks through a rollout that won't break any legitimate email along the way.
How SPF, DKIM and DMARC work together
Think of sending an email like delivering a parcel:
| Record | Analogy | What it checks |
|---|---|---|
| SPF | A list of couriers allowed to deliver for you | Is the sending server authorised for the envelope (Return-Path) domain? |
| DKIM | A tamper-proof seal on the parcel | Was the message signed by the domain, and is it unchanged? |
| DMARC | Your instructions to the recipient's front desk | Does SPF or DKIM pass and match the visible From: domain? If not, what should happen? |
The key concept is alignment. SPF and DKIM can pass for a domain that has nothing to do with the From: address your subscriber sees. DMARC closes that loophole by requiring at least one of them to pass for the same domain as the From: address.
Setting up SPF
SPF is a single TXT record on your domain listing every service allowed to send email for it. A typical record for a business using Google Workspace for staff mail plus a marketing platform looks like this:
Type: TXT Host: @ (or yourbrand.com)
v=spf1 include:_spf.google.com include:spf.your-esp.com ~all
- List every sender. Staff mailboxes, marketing platform, CRM, helpdesk, invoicing tool, website contact forms — anything that sends as your domain.
- Add each one's
include:from its setup documentation. - End with
~all(soft fail) while you're confirming nothing is missing. - Publish one record only. If one already exists, edit it rather than adding a second.
Watch the 10-lookup limit. Each include:, a, mx and redirect counts as a DNS lookup, including lookups nested inside the services you include. Exceed 10 and SPF fails with a permanent error. Remove services you no longer use, or send marketing from a subdomain with its own, shorter SPF record.
Setting up DKIM
DKIM uses a key pair. Your sending service signs each outgoing email with a private key; you publish the matching public key in DNS so receivers can verify the signature.
Type: TXT (or CNAME, if your provider hosts the key)
Host: selector1._domainkey.yourbrand.com
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…
- Generate the key in your sending platform. It gives you a selector name (the part before
._domainkey) and the record value. - Choose 2048-bit keys. Google accepts 1024-bit as a minimum but recommends 2048.
- Publish the record exactly as provided — long keys are sometimes split into quoted chunks by DNS panels, which is fine.
- Set up DKIM for every service that sends as your domain, each with its own selector.
- Rotate keys periodically (many teams do this once or twice a year) by publishing a new selector before retiring the old one.
Make sure DKIM is signed with your domain (d=yourbrand.com), not the platform's default domain — otherwise it won't align for DMARC.
Setting up DMARC
DMARC is a TXT record at _dmarc.yourbrand.com. Start in monitoring mode:
Type: TXT Host: _dmarc
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com; fo=1
| Tag | Meaning |
|---|---|
p | Policy for failing mail: none (monitor), quarantine (spam folder) or reject (block) |
rua | Where daily aggregate reports are sent |
pct | Percentage of failing mail the policy applies to — useful for gradual rollout |
adkim / aspf | Alignment mode: r relaxed (subdomains match, the default) or s strict |
sp | Separate policy for subdomains |
fo | When to generate failure reports (1 = if any check fails) |
A safe DMARC rollout plan
Jumping straight to p=reject is the most common way to accidentally block your own invoices or password resets. Move in stages instead:
- Weeks 1–4:
p=none. Collect reports. Identify every legitimate source sending as your domain and fix its SPF and DKIM. - Next 2–4 weeks:
p=quarantine; pct=25. A quarter of failing mail goes to spam. Check reports and support tickets for anything legitimate being caught. - Then
p=quarantine; pct=100. All failing mail is filtered. - Finally
p=reject. Spoofed mail is blocked outright, and your domain is protected against impersonation.
DMARC at enforcement doesn't just help deliverability — it stops criminals from sending phishing emails that appear to come from your brand.
Aggregate reports arrive as XML files that are hard to read by hand. A free or paid DMARC report analyser turns them into a readable list of sources and pass rates.
Common mistakes to avoid
- Two SPF records on the same domain — merge them into one.
- Forgetting a sender such as the helpdesk or billing system before tightening DMARC.
- DKIM signed with the platform's domain instead of yours, so it passes but doesn't align.
- Sending from a free mailbox domain (Gmail, Yahoo, Outlook). Their DMARC policies mean your campaigns will fail — always send from a domain you own.
- Setting and forgetting. Every new tool that sends email needs to be added to SPF and DKIM.
How to check your setup
- Send a test email to a Gmail address, open it, and choose Show original. You should see
SPF: PASS,DKIM: PASSandDMARC: PASS. - Use any public DNS lookup tool to confirm each record resolves exactly as intended.
- Add your domain to Google Postmaster Tools to monitor authentication rates over time.
Lebx Mail includes an SPF, DKIM and DMARC wizard that generates the records for your sending domain and checks them for you. Once authentication is in place, the next step is building reputation — covered in our complete email deliverability guide.
Frequently asked questions
Do I need all three: SPF, DKIM and DMARC?
Yes. Gmail and Yahoo require bulk senders to have all three, and Microsoft asks the same of high-volume senders to Outlook.com. Even for small senders, the combination is what lets providers trust that mail really comes from you.
Can I have two SPF records?
No. Multiple SPF records on the same domain produce a "permerror" and SPF fails for every message. Merge all your senders into a single record with several include: mechanisms.
Should my SPF record end in ~all or -all?
~all (soft fail) is the common, safer choice while you're still discovering every service that sends for you. Once DMARC is at enforcement, the difference matters little, because DMARC decides what happens to failing mail.
How long do DNS changes take to work?
Usually minutes, but it can take up to the record's TTL — occasionally 24–48 hours — for every resolver to see the change. Verify with a DNS lookup tool before you send a campaign.
What is BIMI and do I need it?
BIMI shows your brand logo next to messages in supporting inboxes such as Gmail and Yahoo. It's optional, but it requires DMARC at enforcement (p=quarantine or p=reject), and Gmail additionally requires a Verified Mark Certificate or Common Mark Certificate.