Setting Up SPF, DKIM & DMARC
Last updated: July 17, 2026
Email authentication proves your messages genuinely come from your domain. Without it, mailbox providers (Gmail, Outlook) are far more likely to junk or reject your mail — and since 2024 both Google and Microsoft require SPF + DKIM + DMARC for bulk senders. Set them up in this order: SPF → DKIM → DMARC.
The three records at a glance
Record | What it does | Where it lives
|
|---|---|---|
SPF | Lists the servers allowed to send mail for your domain | TXT record on your domain |
DKIM | Cryptographically signs your mail so it can't be tampered with or forged | TXT record (published key) |
DMARC | Tells receivers what to do with mail that fails SPF/DKIM, and sends you reports | TXT record at _dmarc.yourdomain |
Setup order & tips
SPF first, then DKIM — let both authenticate for at least 48 hours before turning on DMARC.
Start DMARC at p=none (monitor only) to collect reports without affecting delivery, then tighten to quarantine and eventually reject once you confirm legit mail passes.
DNS changes can take up to 48 hours to propagate.
Only one SPF record per domain — merge sources, don't add a second.
Google Workspace
Set up SPF — support.google.com/a/answer/33786
Set up DKIM — support.google.com/a/answer/174124
Set up DMARC — support.google.com/a/answer/2466580
Microsoft 365
Set up SPF — email-authentication-spf-configure
Set up DKIM — email-authentication-dkim-configure
Set up DMARC — email-authentication-dmarc-configure