SPF, DKIM and DMARC: The Setup That Keeps You Out of Spam

If you send email from your own domain and have never touched your DNS records, there is a good chance mailbox providers do not fully trust you. Since 2024, Google and Yahoo have required authentication from bulk senders outright, and they weigh it heavily for everyone else. These three records are the cheapest deliverability work available — an afternoon, once.

What each one actually does

They answer three different questions, which is why you need all three rather than picking one.

• SPF — "which servers are allowed to send mail for this domain?" A list of authorised senders, published in DNS.
• DKIM — "was this message altered in transit, and does it genuinely come from this domain?" A cryptographic signature on the message itself.
• DMARC — "what should you do if SPF and DKIM fail, and where should you send reports?" The policy that ties the other two together and makes them enforceable.

Setting up SPF

SPF is a single TXT record on your root domain. For Google Workspace, the minimum is:

• Type: TXT · Host: @ (your root domain) · Value: v=spf1 include:_spf.google.com ~all

If you also send through other services — a CRM, a newsletter tool, a transactional provider — each one needs its own include: in the same record. Two separate SPF records on one domain is a misconfiguration that fails outright, and it is the most common SPF mistake.

The ~all at the end means "soft fail" — mark unauthorised mail as suspicious but do not reject it. Start there. Move to -all (hard fail) only once you are certain every legitimate sending service is listed, because anything you forgot will start bouncing.

One more limit worth knowing: SPF allows a maximum of 10 DNS lookups. Each include: can trigger several. Stack up enough services and the record silently stops evaluating — it fails permanently rather than loudly. If you use more than a handful of senders, check your lookup count.

Setting up DKIM

DKIM is generated by your mail provider rather than written by hand. In Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a new record, choose the 2048-bit key, and Google gives you a host and a long value to publish as a TXT record.

1. 1Generate the key in the admin console.
2. 2Publish the TXT record it gives you at your DNS provider. The host looks like google._domainkey.
3. 3Wait for propagation — usually minutes, occasionally up to 48 hours.
4. 4Return to the admin console and click Start authentication. This step is easy to forget, and without it the key exists but is not being used.

Every other sending service you use needs its own DKIM key published the same way. A CRM that sends "from" your domain without DKIM will fail DMARC alignment even when Google Workspace itself is set up perfectly.

Setting up DMARC

One TXT record at the host _dmarc. Start in monitoring mode:

• Type: TXT · Host: _dmarc · Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

p=none means "do not change anything, just tell me what is happening". You will start receiving aggregate XML reports at the rua address showing every source sending mail as your domain — which is genuinely eye-opening the first time, because it usually includes a few services you forgot about.

Run at p=none for two to four weeks. Read the reports, fix any legitimate sender that is failing, then tighten:

1. 1p=none — monitor only. Start here, always.
2. 2p=quarantine; pct=25 — send a quarter of failing mail to spam. Watch for a fortnight.
3. 3p=quarantine; pct=100 — all failing mail to spam.
4. 4p=reject — failing mail is refused outright. The end goal, and the level that actually stops people spoofing your domain.

Verifying it works

The most reliable check costs nothing: send an email to a Gmail address you control, open it, and use Show original from the three-dot menu. You want to see PASS on all three lines — SPF, DKIM, and DMARC. Anything else, the header tells you which one failed and usually why.

Beyond that, Google Postmaster Tools gives you domain reputation and authentication rates over time for mail sent to Gmail, which is the closest thing to an authoritative scoreboard. It needs a modest sending volume before the graphs populate.

What this does and does not fix

Authentication proves you are who you claim to be. It does not make your email wanted. A perfectly authenticated message that recipients delete without reading will still end up filtered, because engagement is the larger part of the modern spam decision.

So treat these three records as the entry ticket rather than the strategy. The rest — list hygiene, sending patterns, whether people actually reply — is covered in why emails land in spam and the email deliverability checklist.

One related question we get often: does open tracking hurt any of this? Mostly no, but the details matter — see does email tracking affect deliverability.