SPF, DKIM and DMARC are three small DNS records that prove your emails really come from your business. Without them, Gmail, Yahoo and Outlook have no way to tell your invoices from a scammer’s, so more of your mail lands in spam or bounces. Setting them up takes an hour or two, and this guide shows you how.
Key takeaways
- SPF lists who may send email for your domain, DKIM signs each message, and DMARC tells inboxes what to do when checks fail.
- Google and Yahoo require every sender to have at least SPF or DKIM. Bulk senders need all three.
- Start by listing every service that sends email as you, including website forms and invoicing tools.
- A domain can have only one SPF record, and it can’t trigger more than 10 DNS lookups.
- Begin DMARC at “none”, read the reports, then tighten it step by step.
Why are my business emails going to spam?
The big mailbox providers stopped giving unauthenticated email the benefit of the doubt. From February 2024, Google’s email sender guidelines require every sender to set up SPF or DKIM. Anyone sending about 5,000 or more messages a day to Gmail must have SPF, DKIM and a DMARC record.
Yahoo introduced the same standards in February 2024, according to its sender best practices. Microsoft followed for Outlook.com, Hotmail and Live addresses. Since 5 May 2025, high-volume senders that fail its checks have their mail sent to Junk, per the Microsoft Defender blog.
Enforcement is getting tougher, not softer. Google’s sender guidelines FAQ says that from November 2025 it is “ramping up its enforcement on non-compliant traffic”, including temporary and permanent rejections. A small business sending a few hundred emails a week isn’t a bulk sender. But missing records still make your mail look suspicious, and that is often why quotes and invoices go missing.
What do SPF, DKIM and DMARC actually do?
Each record answers a different question a receiving mail server asks. Think of them as a guest list, a wax seal and a set of house rules.
SPF: who is allowed to send?
SPF (Sender Policy Framework) is a TXT record listing the servers and services allowed to send email for your domain. If a message comes from a server that isn’t on the list, it fails SPF.
DKIM: has the message been tampered with?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email. Your email service keeps a private key, and you publish the matching public key in DNS. The receiving server checks the signature, which proves the message came from you and wasn’t changed on the way.
DMARC: what happens when checks fail?
DMARC ties the two together. It checks that the domain in the “From” line matches the domain that passed SPF or DKIM. Google calls this alignment in its guide to setting up DMARC. Your DMARC record then tells inboxes to do nothing, quarantine the message or reject it, and to send you reports.
| Record | Where it lives in DNS | What it proves |
|---|---|---|
| SPF | TXT record on your domain (host @) | The sending server is on your approved list |
| DKIM | TXT or CNAME record at a “selector” your email service gives you | The message is signed by you and unchanged |
| DMARC | TXT record at _dmarc | The From domain lines up with SPF or DKIM, plus your policy |
How do I set up SPF, DKIM and DMARC?
You add all three in the DNS settings for your domain. If you’re not sure where those are, our guide to domain management explains how to find out who controls your DNS.
- List everything that sends email as you. Include your mailbox provider (Microsoft 365 or Google Workspace), website contact forms, online shop receipts, newsletters, invoicing, booking and CRM tools.
- Find where your DNS is hosted. It may be your registrar, your host or a service like Cloudflare. Records added anywhere else are ignored.
- Publish one SPF record. Combine every sending service into a single TXT record that starts with v=spf1.
- Turn on DKIM in each service. Each one gives you a record to add, usually a TXT or CNAME at a selector name. Add it, then press “verify” or “start signing” in the service.
- Add a DMARC record at “none”. Something like v=DMARC1; p=none; rua=mailto:[email protected] starts the reports without blocking anything.
- Test, then wait. Send messages to a Gmail and an Outlook address and check the headers for “pass”. Changes can take time to show, which our explainer on DNS propagation covers.
- Tighten DMARC slowly. Once reports show all your real email passing, move to quarantine for a small share of mail, then 100%, then reject if you want full protection.
Google suggests setting up SPF and DKIM at least 48 hours before DMARC. Its recommended DMARC rollout then runs at “none” for at least a week, before quarantining a small percentage and increasing it.
What should my SPF record look like?
A business using Microsoft 365 plus a newsletter tool might publish something like v=spf1 include:spf.protection.outlook.com include:(newsletter provider’s value) ~all. Each provider tells you the exact include to use. Each include pulls in that provider’s list of servers. The ending sets how strict you are: ~all means “treat others as suspicious” and -all means “fail anything not listed”.
Two rules catch out a lot of businesses. The SPF standard, RFC 7208, allows only one SPF record per domain, and two records cause a permanent error. It also caps the DNS lookups SPF can trigger at 10. Every include counts, and some providers’ includes contain more of their own.
Tip: When you add a new tool, edit your existing SPF record instead of adding a second one. Two SPF records is a common fault, and it breaks SPF for every message.
How do I read DMARC reports?
With a rua address in your DMARC record, mailbox providers send you daily summaries of mail that claimed to come from your domain. Google notes that busy domains can get many reports a day, so use a dedicated mailbox. The reports are XML files, which aren’t meant to be read by hand.
Free and paid DMARC report tools turn them into plain charts. Look for two things. First, real services that fail, such as a booking system you forgot to add to SPF. Second, sources you don’t recognise, which may be someone spoofing your domain.
For quick spot checks, Google’s free Check MX tool tests your MX and SPF records, and DKIM if you enter the selector.
What about domains that don’t send email?
Spare domains are easy targets for spoofing because nobody watches them. If a domain never sends email, lock it down. The UK Government’s guidance on protecting domains that don’t send email recommends three records:
- SPF: v=spf1 -all (nothing is allowed to send).
- DMARC: a record with p=reject, so receivers drop anything claiming to be from the domain.
- A “null MX” record, which says the domain accepts no mail. Some DNS providers don’t support it.
If you own several domains, add this to your list of jobs alongside renewals. Our domain and DNS management page explains how we can look after your domains and DNS in one account.
What are the most common mistakes?
- Forgetting the website. WordPress forms often send from the web server itself, which isn’t in SPF. An SMTP plugin that sends through your real email service fixes this.
- Jumping straight to reject. If one real service isn’t set up yet, its mail disappears. Start at none and work up.
- Losing records when you move. Changing host or DNS provider without copying every record can break email overnight. If you’re moving, ask about our free website migration and check every email record comes across.
- Weak or missing DKIM keys. Google requires DKIM keys of at least 1024 bits and recommends 2048.
- Setting it and forgetting it. Each new tool that sends as you needs adding to SPF and DKIM.
If you’re still setting up your mailbox, start with our guide to getting a business email address, then come back here for the records.
Starting from scratch with a new name? You can register your domain with WMS and set up these records from the first day.
Frequently asked questions
Do I need SPF, DKIM and DMARC if I only send a few emails?
Yes. Google and Yahoo require every sender to have at least SPF or DKIM, and bulk senders need all three. Even at low volumes, all three records make your email more trusted and make it much harder for scammers to send fake invoices that appear to come from your domain.
What is a DMARC record?
A DMARC record is a TXT record at _dmarc on your domain. It tells receiving servers what to do with email that fails SPF and DKIM alignment: nothing, quarantine it or reject it. It can also ask them to send you daily reports about mail using your domain.
Can I have two SPF records?
No. The SPF standard allows only one SPF record per domain, and publishing two causes a permanent error, so SPF fails for every message. Combine all your sending services into one record, and keep the total DNS lookups at 10 or fewer.
Should my DMARC policy be quarantine or reject?
Reject gives the strongest protection against spoofing, but only move there once reports show all your real email passing. Most businesses start at none, move to quarantine for a small percentage, increase it to 100%, and then switch to reject.
Why do emails from my website contact form go to spam?
Usually because the form sends from your web server, which isn’t listed in SPF and doesn’t sign with DKIM. Set the form up to send through your real email service using an SMTP plugin, and the messages will pass the checks.
Sources
- Email sender guidelines, Google
- Email sender guidelines FAQ, Google
- Sender best practices, Yahoo
- Strengthening email security: Outlook’s new requirements for high-volume senders, Microsoft, April 2025
- Set up DMARC, Google Workspace Help
- Recommended DMARC rollout, Google Workspace Help
- RFC 7208: Sender Policy Framework, IETF, April 2014
- Check MX, Google Admin Toolbox
- Protect domains that don’t send email, UK Government Digital Service, updated March 2021