How to Set Up and Fix SPF, DKIM, and DMARC: A Step-by-Step Guide
Learning how to set up SPF, DKIM, and DMARC is simpler than those acronyms suggest. Most people can fix their email authentication in under an hour.
If someone told you that your emails aren't being delivered because your "SPF record has too many DNS lookups" or your "DKIM signature isn't aligning with your RFC5322.From domain," you'd be forgiven for wanting to throw your laptop out the window.
But here's the thing: learning how to set up SPF, DKIM, and DMARC is much simpler than those acronyms suggest. Most people can fix their email authentication in under an hour. And in 2026, it's not optional — it's required.
This guide walks you through every step in plain English.
Why Email Authentication Is Mandatory in 2026
This isn't a best practice anymore. It's a hard requirement.
In February 2024, Gmail and Yahoo began enforcing email authentication for bulk senders. Gmail escalated to outright rejection of non-compliant messages in November 2025. Microsoft followed in May 2025, rejecting emails from high-volume senders without proper SPF, DKIM, and DMARC alignment.
Domains with full authentication see dramatically better inbox placement. Without it, your emails aren't just going to spam — they're being bounced before they ever reach a mailbox.
What Are SPF, DKIM, and DMARC? (The Simple Version)
Think of email authentication like a security checkpoint at an airport:
SPF is your ticket — it tells receiving servers which mail servers are authorized to send email from your domain. Like a guest list that says "these people are allowed in."
DKIM is your passport — it adds a cryptographic signature to every email, proving the message hasn't been tampered with in transit and genuinely came from your domain.
DMARC is the security officer — it checks whether SPF or DKIM passed, decides what to do with failures (nothing, quarantine, or reject), and sends you reports about who's using your domain to send email.
You need all three. Here's how to set each one up.
How to Set Up SPF (Sender Policy Framework)
What SPF does
SPF is a DNS TXT record that lists every server authorized to send email on behalf of your domain. When Gmail receives an email claiming to be from yourdomain.com, it checks your SPF record to see if the sending server is on the list.
Step 1: Check if you already have an SPF record
Go to a SPF checker and enter your domain. You'll see one of three outcomes: no record found, record found with errors, or record found passing.
Important: You can only have ONE SPF record per domain. Multiple records break authentication entirely.
Step 2: Identify all your sending services
List every platform that sends email from your domain. Common ones include:
- Your email provider (Google Workspace, Microsoft 365)
- Marketing platforms (Mailchimp, HubSpot, ActiveCampaign)
- Transactional email services (SendGrid, Postmark, Mailgun)
- CRM systems (Salesforce, HubSpot)
- Support tools (Zendesk, Intercom, Freshdesk)
Step 3: Build or update your SPF record
Each service publishes their SPF include value in their documentation. Your record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net include:mail.zendesk.com ~all
v=spf1— Identifies this as an SPF record- Each
include:— Authorizes that service's servers ~all— Soft-fails anything not on the list (best practice — lets DMARC handle enforcement)
Step 4: Add it to your DNS
Log into your domain registrar (GoDaddy, Cloudflare, Namecheap, etc.), go to DNS settings, and add or update the TXT record.
Common SPF mistakes to avoid
Too many DNS lookups. SPF has a hard limit of 10 DNS lookups. Every include: counts as at least one, and some trigger additional lookups. Exceeding 10 causes your entire SPF record to fail silently. Use an SPF flattening tool if you're hitting this limit.
Using -all instead of ~all. The hard fail (-all) tells servers to reject non-matching emails immediately, before checking DKIM or DMARC. Use soft fail (~all) and let DMARC handle enforcement.
Forgetting a sending service. That CRM you added six months ago? That invoice tool? If they send email from your domain and aren't in your SPF record, those messages fail authentication.
How to Set Up DKIM (DomainKeys Identified Mail)
What DKIM does
DKIM adds a cryptographic signature to every outgoing email. The receiving server checks this signature against a public key in your DNS to verify the email is authentic and unaltered.
Step 1: Generate DKIM keys in your email provider
Unlike SPF, DKIM setup starts inside your sending platform's dashboard. Every major provider has a DKIM setup guide — search their docs for "DKIM setup" or "email authentication."
The provider generates two things:
- A public key (a DNS TXT record you'll add to your domain)
- A private key (used by the server to sign your outgoing emails)
Step 2: Add the public key to your DNS
The record will have a specific selector (like google._domainkey.yourdomain.com) and a long string of characters. Add this as a TXT record in your DNS settings.
Step 3: Enable DKIM signing
Go back to your email provider and toggle DKIM signing on. This step is critical — many people add the DNS record and assume they're done. Adding the public key is only half the process.
Step 4: Repeat for every sending service
Each platform that sends email from your domain needs its own DKIM configuration. Your marketing tool, your transactional email service, your CRM — all of them.
How to verify DKIM is working
Send a test email to a Gmail account. Open it, click the three dots → "Show original." Look for DKIM: PASS in the authentication results.
Common DKIM mistakes
Not enabling signing after adding the DNS record. Especially common with Google Workspace — people add the DNS record and never toggle DKIM on in the admin console.
Using 1024-bit keys. Use 2048-bit keys for stronger security. Most providers now default to this, but check.
Missing DKIM on secondary senders. If your marketing platform signs with DKIM but your transactional service doesn't, those transactional messages fly without a signature.
How to Set Up DMARC (Domain-based Message Authentication, Reporting and Conformance)
What DMARC does
DMARC sits on top of SPF and DKIM. It checks whether either protocol passed and whether the domain aligns with your visible "From" address. Then it tells receiving servers what to do with failures. It also sends you reports about every email sent using your domain — including ones you didn't send.
Step 1: Make sure SPF and DKIM are working first
DMARC depends on both. Don't set up DMARC until you've confirmed SPF and DKIM pass. Google recommends waiting at least 48 hours after setting up SPF and DKIM before enabling DMARC.
Step 2: Start with monitoring mode
Add this TXT record to your DNS at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
p=none— Don't take action on failures yet, just send reportsrua=mailto:...— Where to send aggregate reports
Step 3: Review DMARC reports for 2–4 weeks
DMARC reports show you every IP address sending email as your domain, which ones pass authentication, and which fail.
Look for: legitimate sending services that are failing authentication (fix their SPF/DKIM), unauthorized senders trying to spoof your domain (this is why you need DMARC), and alignment issues between your From domain and your SPF/DKIM domains.
Step 4: Move to enforcement
Once you've confirmed all legitimate email passes authentication:
Quarantine (sends failures to spam):
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com
Reject (blocks failures entirely — the gold standard):
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com
Common DMARC mistakes
Jumping straight to p=reject. If you enforce rejection before confirming all legitimate senders pass, you'll block your own emails. Always start with p=none.
Never moving past p=none. On the flip side, many organizations publish a monitoring-only policy and never enforce it. A p=none policy doesn't protect you from spoofing — it just watches. The whole point is to get to quarantine or reject.
Alignment failures. DMARC requires that the domain used by SPF or DKIM aligns with your visible From address. If your marketing tool sends with a return-path of bounce.marketingtool.com but your From is you@yourdomain.com, SPF won't align. You need DKIM alignment in that case.
The Right Order of Operations
If you're starting from scratch:
- SPF first — Easiest to set up, most immediate impact
- DKIM second — More involved (requires setup in each sending platform), but critical
- DMARC third — Only after SPF and DKIM work. Start
p=none, move to enforcement over 2–4 weeks
DNS propagation can take up to 48 hours, so don't panic if changes aren't reflected immediately.
Don't Set It and Forget It
This is where most people fail. They set up authentication once and never check it again. Then someone on the team adds a new email tool, the SPF record doesn't get updated, and suddenly half their emails fail authentication for weeks before anyone notices.
Email authentication requires ongoing maintenance:
- Review records monthly when infrastructure is stable
- Audit immediately after any change — new domain, new ESP, new CRM
- Monitor continuously for configuration drift
MailVitals automates this monitoring. It continuously checks your SPF, DKIM, and DMARC configuration across all your domains and alerts you instantly when something breaks — before your deliverability suffers.
👉 Related: Why Are My Emails Going to Spam?