SPF, DKIM and DMARC in ten minutes

You can write the best email of your life and still have nobody read it. Not because the subject line is weak, but because the receiving server can’t tell whether you really sent it, and when in doubt, it sends it to spam.

That doubt is what three records published in your domain’s DNS are for: SPF, DKIM and DMARC. Since 2024, Gmail and Yahoo have required them from anyone sending email to their users, and since 2025 so has Outlook. The good news is that you set them up once, in about ten minutes, and never have to touch them again. In this article we explain what each one does, how to set them up in Google Workspace and Microsoft 365 and how to check they’re working.

The problem: anyone can write your address

Email was designed at a time when nobody was thinking about impersonation. The protocol lets any server send a message that says “From: emma@yourcompany.com”, just as anyone can write your address as the return address on the back of an envelope.

SPF, DKIM and DMARC are how you prove the envelope is yours. Each one answers a different question:

• SPF: is this server allowed to send email for this domain?
• DKIM: does the message carry the domain’s signature, and has it been left unchanged along the way?
• DMARC: if any of the above fails, what should the receiving server do? And who should it tell?

A good comparison is a registered letter: SPF is the list of post offices authorized to send on your behalf, DKIM is the wax seal and DMARC is the instructions you leave at the destination post office about what to do with a letter that has no seal.

SPF: who can send on your behalf

SPF (Sender Policy Framework) is a text (TXT) record on your domain listing the servers allowed to send email on its behalf. When a message arrives, the receiving server checks where it came from and compares it against that list.

An SPF record looks like this:

v=spf1 include:_spf.google.com ~all

• v=spf1 says it’s an SPF record.
• include:_spf.google.com authorizes Google Workspace’s servers. With Microsoft 365 it would be include:spf.protection.outlook.com.
• ~all says any other server is “probably not” authorized (soft fail). With -all the fail is strict.

Three common mistakes:

1. Having two SPF records. There can only be one per domain. If you use Google Workspace and also an invoicing tool that sends emails, both include entries go in the same record: v=spf1 include:_spf.google.com include:otherservice.com ~all.
2. Going over ten lookups. Each include counts as one DNS lookup, and some hide others inside them. The standard sets a maximum of ten; above that, the check fails.
3. Forgetting a service. If you send from a server that isn’t on the list (your website, your CRM, a prospecting tool with its own SMTP), those emails will fail SPF.

DKIM: a signature on every email

DKIM (DomainKeys Identified Mail) adds a digital signature to every email. Your provider signs the message with a private key that only it has, and you publish the public key in your DNS so anyone can verify the signature. If someone changes a single comma in the message along the way, the signature no longer matches.

Unlike SPF, you don’t make up the DKIM key yourself: your email provider generates it and you just copy it into your DNS.

• Google Workspace: in the Admin console, go to Apps › Google Workspace › Gmail › Authenticate email, generate a 2048-bit key and copy the TXT record it gives you, with the name google._domainkey. Then go back to the console and click Start authentication.
• Microsoft 365: in the Microsoft Defender portal, the DKIM settings for your domain show you two CNAME records (selector1._domainkey and selector2._domainkey). You create them in your DNS and turn on signing.

The part before ._domainkey is called the selector. It lets one domain have several keys, for example one for Google and another for your invoicing tool.

DMARC: what to do when something fails

SPF and DKIM check things, but they don’t say what to do if they fail. DMARC (Domain-based Message Authentication, Reporting and Conformance) does, and it adds an important condition: alignment. It’s not enough for the email to pass SPF or DKIM; the domain that passes them has to be the same one that appears in the “From:” the recipient sees.

The DMARC record is another TXT record, with the name _dmarc on your domain:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

• p= is the policy: none (do nothing, just report to me), quarantine (send it to spam) or reject (reject it).
• rua= is the address where the big providers send you daily reports on who is sending email on behalf of your domain and whether it passes the checks.

How to move forward without breaking anything:

1. Start with p=none and an rua address. It’s the minimum Google, Yahoo and Microsoft require.
2. For a few weeks, look at the reports (there are free services that turn them into something readable). Look for legitimate services that fail: the website that sends form emails, the invoicing tool, the newsletter.
3. Once everything legitimate passes, move up to p=quarantine and, later on, to p=reject. From then on, anyone trying to impersonate your domain will have a very hard time.

What Gmail, Yahoo and Outlook require

Since February 2024, Google and Yahoo have required SPF or DKIM from all senders. Anyone sending more than 5,000 emails a day to Gmail accounts must also have SPF, DKIM and DMARC (p=none is enough), alignment with the “From:” domain, one-click unsubscribe and a spam complaint rate below 0.3%. Since May 2025, Outlook has required the same from high-volume senders.

If you prospect from your own mailbox, you probably don’t reach 5,000 a day. But filters don’t just apply rules: they also score trust. A domain with all three records properly set up starts with an advantage over one without them, even if it sends little.

How to check it’s working

The simplest way needs no tools:

1. Send yourself an email from your mailbox to a Gmail account.
2. Open it, click the three dots and choose Show original.
3. At the top you’ll see three lines: SPF: PASS, DKIM: PASS and DMARC: PASS. If any of them says FAIL or is missing, you know what to check.

Keep in mind that DNS changes can take anywhere from a few minutes to a few hours to propagate. If you’ve just created a record and the check fails, wait a while before touching anything else.

The ten-minute checklist

• A single SPF record with every service that sends on your behalf.
• DKIM generated in your provider (Google Workspace or Microsoft 365), published in your DNS and turned on.
• A DMARC record at _dmarc with p=none and an rua address for reports.
• Test with “Show original” in Gmail: three PASS.
• In a few weeks, review the reports and move up to quarantine.

With this, the email you worked so hard to write at least gets the chance to be read.