How do I set up SPF, DKIM and DMARC for my business?
List every service that sends email as your domain, then publish one SPF record covering them all, turn on DKIM signing in each service, and add a DMARC record set to monitor only (p=none). Read the reports for at least a week, fix any sender that fails, then tighten DMARC to quarantine and finally reject.
Download the email deliverability checklist (PDF)6 pages, 384 KB, free to print. What's inside
The short version
- Make a list of every service that sends email using your domain, not just your mailbox.
- Publish exactly one SPF record that includes all of them.
- Turn on DKIM in each service, and add the DNS records it gives you.
- Add DMARC with
p=noneand a reporting address, then read the reports. - When every real sender passes, move DMARC to
quarantine, thenreject.
What do SPF, DKIM and DMARC each do?
They’re three text records in your domain’s DNS that prove your email is really from you. SPF lists the services allowed to send for your domain. DKIM adds a digital signature to each message that receivers check against a key in your DNS. DMARC tells inboxes what to do when a message fails, and sends you reports. Our answer on what SPF, DKIM and DMARC are explains each one in plain English. This article is the setup.
What do Gmail, Yahoo and Microsoft require now?
The big inbox providers have turned these records from good practice into rules.
| Every sender | Bulk senders | |
|---|---|---|
| Gmail | SPF or DKIM, valid reverse DNS, TLS, low spam complaints | Also SPF and DKIM, DMARC (at least p=none), From domain aligned, one-click unsubscribe |
| Yahoo | SPF or DKIM, low spam complaints | Also SPF and DKIM, DMARC (at least p=none) that passes, one-click unsubscribe |
| Outlook.com, Hotmail, Live | No separate list published | SPF and DKIM must pass, DMARC at least p=none, aligned |
Gmail’s sender guidelines took effect on February 1, 2024. They ask every sender to keep its spam rate in Postmaster Tools below 0.3%, and recommend staying under 0.1%. Gmail counts you as a bulk sender at 5,000 or more messages a day to Gmail accounts.
Yahoo’s sender requirements set the same baseline and ask bulk senders to honor unsubscribe requests within two days.
Microsoft’s requirements for high-volume senders cover domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses, starting May 5, 2025.
Most small businesses aren’t bulk senders. But your newsletter tool sends using your domain, and its volume and setup count toward your reputation. Setting up all three records is the right move at any size.
How do I set them up, step by step?
1. List everything that sends as you
This is the step people skip, and it’s why their own invoices end up blocked later. Check for:
- Your mailbox provider (Microsoft 365, Google Workspace or another host)
- Your website’s contact forms
- A newsletter or marketing tool
- Invoicing or accounting software
- Booking, scheduling or CRM tools
- Your online store’s order emails
- Anything else that sends “from” your domain
2. Check what you have now
Run your domain through our free email deliverability checker. Note whether SPF, DKIM and DMARC exist, and whether there’s more than one SPF record. Before you change anything, save a copy of every existing DNS record. Our answer on changing DNS without breaking email explains why that copy matters.
3. Fix SPF
A domain gets one SPF record. It starts with v=spf1, lists each sender with an include: entry from that sender’s own instructions, and ends with an ~all or -all. A simplified shape looks like this:
v=spf1 include:mail-provider.example include:newsletter-tool.example ~all
Two rules from the SPF standard, RFC 7208, catch people out. Publishing more than one SPF record for the same domain is an error, so a new tool’s record must be merged into the existing one. And SPF checks may follow no more than 10 DNS lookups, so a long chain of include: entries can break it.
4. Turn on DKIM everywhere
You don’t write DKIM keys by hand. In each service’s admin area, find the DKIM or “authenticate your domain” setting. Copy the records it gives you, add them to DNS, then go back and switch signing on. That last click is often missed. Repeat for each service on your list. Gmail requires keys of at least 1024 bits and recommends 2048 where your provider supports it.
5. Add DMARC in monitoring mode
Add a TXT record at _dmarc.yourdomain.com such as:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
p=none blocks nothing. The rua address receives daily summary reports from big inbox providers showing which servers sent mail as your domain and whether it passed. Google’s DMARC rollout guide suggests having SPF and DKIM working for at least 48 hours before you add DMARC.
6. Read the reports and fix what fails
Google suggests watching at least a week of reports, enough to see every mail stream. You’ll often find a sender you forgot, like an old form plugin or a booking tool. Add it to SPF, set up its DKIM, or both. The reports are raw data files, so most people use a DMARC reporting service, or their IT provider, to read them.
7. Tighten the policy
When real mail passes consistently, change p=none to p=quarantine, so failing mail goes to spam. Google’s guide describes applying it to a small share of mail first and raising it over time. Then move to p=reject, which tells receivers to refuse failing mail. That’s the strongest protection against someone spoofing your domain.
8. Recheck after every change
Any time you add a tool that sends email for you, switch email providers, or move DNS, check that the new sender is covered before you rely on it.
Why does this matter for a small business?
Without these records, two things happen. Your real email, including quotes and invoices, is more likely to land in spam, because inboxes can’t confirm it’s from you. And scammers can more easily send email that looks like yours, such as a fake invoice with new bank details sent to your customers. If that’s happening already, read what to do when someone sends fake emails as you.
We see the effects all the time. In our support records since 2019, “Why are good emails landing in my junk folder?” accounts for about 150 requests, and “Why are my form emails going to spam or missing?” for nearly 190.
What are the most common mistakes?
- Two SPF records. A new tool told you to “add an SPF record,” so now there are two, and both fail.
- Too many lookups. Every tool you’ve ever tried is still in SPF, pushing it past the 10-lookup limit.
- DKIM records added but signing never switched on.
- Jumping straight to
rejectand blocking your own invoices or form notices. - Forgetting the website. Many sites send form notices straight from the web server, which isn’t in SPF and doesn’t sign with DKIM for your domain.
- No reporting address, so nobody ever sees what’s failing.
- Editing DNS without a copy of the records you started with.
What about website forms and other tools?
Contact forms are one of the most common sources of lost mail. The fix is to send form notices through a proper email service that’s authenticated for your domain, not from the web server itself. Our help article on why form emails go to spam or go missing walks through it. Online stores have the same issue with order emails; see why customers aren’t getting order confirmations.
What if email still lands in spam?
Authentication is the foundation, not the whole story. Spam complaints, heavy images or links, a sending server with a poor reputation and old mail systems all play a part. Our answer on why business emails go to spam covers those causes, and why good emails land in your junk folder covers mail you receive. If a message bounces outright, start with why messages bounce.
How long does it take?
Listing senders and checking your records takes under an hour. Each DNS change usually shows up within minutes to a few hours; our answer on why DNS changes take time explains the delay. The careful part is DMARC: at least a week of monitoring, then a gradual move to quarantine and reject, so a full rollout usually takes several weeks. The records themselves cost nothing to publish.
How does E-3 handle this?
Adding DNS records for a new email or marketing service is one of the more common requests in our support records, with about 130 since 2019. For business email E-3 sets up, we publish SPF, DKIM and DMARC as part of the job, save a copy of your DNS before touching it, and recheck the records whenever you add a new tool. You’ll see what’s changing before it changes.
Related questions
Common questions
- My business only sends a few emails a day. Do I still need these records?
- Yes. Gmail and Yahoo require SPF or DKIM from every sender, whatever the volume. Having all three also makes it much harder for scammers to send email that looks like it came from you.
- Will DMARC block my own email?
- Not if you start with p=none, which only asks for reports. Move to quarantine and then reject only once the reports show every legitimate sender passing.
- Where do I add these records?
- Wherever your domain's DNS is managed. That might be your registrar, your web host or a service like Cloudflare. Each email service gives you the exact values to add.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.