SPF, DKIM and DMARC setup, step by step

Anyone can type your domain into the From line of an email. SPF, DKIM and DMARC are three DNS based checks that let a receiving server tell your real mail from a forgery, and they decide more of your deliverability than the mail software does. This guide sets up all three, in the order that avoids breaking your own mail.

What each record does

• SPF (Sender Policy Framework, RFC 7208) is a TXT record that lists the servers allowed to send mail using your domain in the envelope sender.
• DKIM (DomainKeys Identified Mail, RFC 6376) adds a cryptographic signature to each message. The public key sits in DNS, so the receiver can check that the message was signed by you and not changed on the way.
• DMARC (RFC 7489, which the IETF page now marks as obsolete in favour of newer documents, though the record format below is still what receivers read) ties them together. It says that SPF or DKIM must pass and must line up (be aligned) with the domain in the visible From address, and what to do if neither does.

Step 1: publish SPF

Make a list of everything that sends mail as your domain: your own mail server, your website's contact form, a newsletter service, an invoicing tool. Then publish one TXT record at the domain root:

example.com.  TXT  "v=spf1 mx ip4:203.0.113.10 include:_spf.mailprovider.example ~all"

Reading it from left to right: mx allows the servers in your MX records, ip4: allows one address, include: borrows another sender's list, and ~all says "everything else is a soft fail". Once the reports show nothing legitimate is failing, you can change ~all to -all for a hard fail.

Two limits catch people out. First, a domain may have only one SPF record; two records give a permanent error. Second, RFC 7208 section 4.6.4 says an evaluation must not make more than 10 DNS lookups. The terms include, a, mx, ptr, exists and redirect each count, and going over the limit also produces a permanent error. Ip4 and ip6 entries cost nothing, so replace a chain of includes with addresses where the sender's addresses are stable. The same section suggests limiting "void lookups" (lookups that return nothing) to two.

Step 2: create and publish a DKIM key

Your mail server signs outgoing mail with a private key and you publish the public half. With Rspamd, OpenDKIM or a panel, the key generation looks like this:

rspamadm dkim_keygen -s mail -b 2048 -d example.com -k /var/lib/rspamd/dkim/example.com.mail.key

The command prints a TXT record. Publish it at mail._domainkey.example.com (the part before _domainkey is the selector, which lets you rotate keys later by adding a new selector). Google's sender guidelines, which we opened on 30 October 2026, ask for DKIM keys of at least 1024 bits and recommend 2048. A 2048 bit key is longer than 255 characters, so your DNS host must split it into several quoted strings; most do this automatically.

Step 3: publish DMARC in monitoring mode

Add a TXT record at _dmarc.example.com:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

p=none asks receivers to do nothing to failing mail but to send you reports. rua is where the daily aggregate reports go, adkim and aspf choose relaxed (the default) or strict alignment. The record must start with v=DMARC1. Use a mailbox you actually read, or a report service, because the reports arrive as compressed XML files.

Step 4: test before you trust

Send a message to a Gmail address and open "Show original". You want to see spf=pass, dkim=pass and dmarc=pass. You can also query the records directly:

dig +short TXT example.com
dig +short TXT mail._domainkey.example.com
dig +short TXT _dmarc.example.com

Check that dkim=pass names your own domain (header.d=example.com). If it names your mail provider's domain, DKIM passes but is not aligned, so DMARC still depends on SPF.

Step 5: tighten DMARC in stages

Leave p=none for two to four weeks and read the reports. They list every IP address that sent mail as your domain, and whether it passed. Add legitimate senders you forgot to SPF or DKIM. When all your real mail passes, tighten the policy:

1. p=quarantine; pct=10 sends 10 percent of failing mail to spam.
2. Raise pct to 50, then 100 over a couple of weeks.
3. p=reject tells receivers to refuse failing mail. Add sp=reject if you want the same for subdomains, or set sp separately, because without it the main policy applies to subdomains too.

Reports are not affected by pct. Keep the rua address for good; a new sender added next year will show up there first.

What the big receivers expect

Google's requirements for senders of more than 5,000 messages a day to Gmail accounts (effective 1 February 2024, checked 30 October 2026 at Google's sender guidelines) are SPF and DKIM, a DMARC record (the policy may be none), valid forward and reverse DNS, TLS, a spam rate under 0.30 percent in Postmaster Tools, and one click unsubscribe on marketing mail. Small senders are not exempt from the checks, only from the bulk label, so set all three up even for a quiet domain.

Common mistakes

• Two SPF records. Merge them into one.
• More than 10 lookups. Count your includes. Each included service may itself include others.
• A forgotten sender. The contact form, the invoicing tool and the helpdesk all send as your domain. Reports reveal them.
• Strict policy too early. Going straight to p=reject is how a company's own invoices end up bounced.
• Wrong DKIM selector. The record name must be selector._domainkey; a typo gives dkim=none.
• Forgetting subdomains. Domains you never send from should have v=spf1 -all and a reject policy, which stops spoofing of them.

If you run your own server, the wider checklist (reverse DNS, TLS, MTA-STS, open relays) is in how to set up a mail server the right way. RespireCloud's mail feature publishes SPF, DKIM and DMARC records into the domain's zone when you add a mail domain, which saves the typing but not the reading of the reports.

Which one should you do first

Do SPF first because it takes ten minutes, DKIM second because it needs a key on the mail server, and DMARC last because it is only useful once the first two pass. Then spend the patience on the reports, not on the record.