SPF, DKIM and DMARC setup: a plain-English guide

Updated October 25, 2026

SPF, DKIM and DMARC setup comes down to three DNS TXT records on your domain: SPF lists the servers allowed to send your mail, DKIM publishes a key that proves messages were not altered, and DMARC tells receivers what to do when a message fails. This guide covers each one in order.

What are SPF, DKIM and DMARC?

They are three email authentication standards published as DNS records. SPF (Sender Policy Framework) lists which servers may send mail for your domain. DKIM (DomainKeys Identified Mail) signs each message so receivers can verify it with a public key in your DNS. DMARC links both to the From: address readers see and sets a policy for failures.

The specifications are RFC 7208 for SPF, RFC 6376 for DKIM, and RFC 9989 for DMARC. RFC 9989 was published in May 2026 and replaces the original DMARC document, RFC 7489. Records written for RFC 7489 keep working.

Do I need all three?

Yes, for any domain that sends real mail. Google requires every sender to Gmail to use SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts must have SPF, DKIM and DMARC, with a DMARC policy of at least p=none. Yahoo uses the same split, and Microsoft applies a similar rule for Outlook.com.

• Gmail: all senders need SPF or DKIM, a valid PTR record and TLS; bulk senders (over 5,000 messages a day) need SPF, DKIM and DMARC, with the From: domain aligned to SPF or DKIM. Spam rates reported in Postmaster Tools must stay below 0.3%. (Google)
• Yahoo: all senders need SPF or DKIM and a spam rate below 0.3%; bulk senders need both SPF and DKIM plus a DMARC policy of at least p=none that passes. (Yahoo)
• Outlook.com, Hotmail.com and Live.com: since May 5, 2025, Microsoft requires senders of more than 5,000 messages a day to its consumer addresses to pass SPF and DKIM and publish DMARC with at least p=none, aligned with SPF or DKIM. Non-compliant mail is filtered or rejected. (Microsoft)

Below those volumes, all three are still worth having: they take minutes to publish and make your domain much harder to impersonate.

How do I set up SPF?

Publish one TXT record at the root of your domain (host @). It starts with v=spf1, lists every service that sends mail as you with include:, ip4: or ip6: terms, and ends with ~all or -all. If several services send for you, merge them into that single record.

Google Workspace only (Google):

v=spf1 include:_spf.google.com ~all

Microsoft 365 only (Microsoft):

v=spf1 include:spf.protection.outlook.com -all

Google Workspace plus a sending tool (use the include value from your tool's documentation):

v=spf1 include:_spf.google.com include:spf.your-sending-tool.example ~all

~all or -all? Google recommends ~all (soft fail). Microsoft recommends -all (hard fail) when DKIM and DMARC are also in place, noting that DMARC counts both as SPF failures. Either is acceptable. Do not use ?all, which says nothing, or +all, which authorizes every server on the internet.

What is the SPF 10-lookup limit?

An SPF check may trigger at most 10 DNS lookups. Every include, a, mx, ptr and exists mechanism and every redirect counts, including the ones nested inside records you include. Go over 10 and the result is a permanent error, so SPF does not pass. ip4, ip6 and all do not count.

RFC 7208 also lets receivers fail SPF after more than 2 "void" lookups, meaning lookups that return no record. (RFC 7208, section 4.6.4) To get back under the limit:

• Remove includes for services you no longer use.
• Replace a and mx with the actual ip4: or ip6: ranges if they rarely change.
• Check whether a sending tool uses its own bounce (Return-Path) domain. If it does, SPF is checked against that domain, not yours, and its include may not be needed at your root.

The checker counts your lookups, including nested ones, and lists each one.

How do I set up DKIM?

Turn on DKIM signing in every service that sends mail as your domain, then publish the public key it gives you as a TXT record, or the CNAME records it asks for, at selector._domainkey.yourdomain. The provider picks the selector. Use a 2048-bit key where the provider and your DNS host support it.

• Google Workspace generates the key in the Admin console. The default selector is google.
• Microsoft 365 asks for two CNAME records, selector1._domainkey and selector2._domainkey, that point to keys Microsoft hosts and rotates.
• Sending tools such as cold email or marketing platforms give you their own selector and record. Set this up in each one so mail is signed with your domain, not theirs.

Google requires a DKIM key of at least 1024 bits to send to personal Gmail accounts and recommends 2048 bits. (Google) A 2048-bit key is longer than the 255-character limit for a single DNS string, so it is stored as several quoted strings that receivers join together. Most DNS hosts do this automatically.

How do I set up DMARC?

Publish a TXT record at _dmarc.yourdomain that starts with v=DMARC1, sets a policy with p=, and names a mailbox for aggregate reports with rua=. Start with p=none so nothing is blocked while you read the reports, then tighten the policy once every legitimate sender passes.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Google recommends waiting at least 48 hours after setting up SPF and DKIM before adding DMARC, then staying on p=none for about a week while you review reports. (Google) If rua points to a different domain, such as a reporting service, that domain must publish an authorization record or receivers will not send it your reports. (RFC 9990, section 4)

For what each policy does and how to move from monitoring to enforcement, see DMARC policy: p=none vs quarantine vs reject.

What does DMARC alignment mean?

Alignment means the domain that passed SPF or DKIM matches the domain in the visible From: address. DMARC passes when at least one of the two both passes and aligns. Relaxed alignment, the default, accepts any domain under the same organizational domain; strict alignment requires an exact match.

This is why DKIM matters most for third-party tools. A tool that sends from its own bounce domain passes SPF for itself, but that does not align with your From: domain. If it signs with DKIM using your domain (d=yourdomain), DMARC still passes. (RFC 7489, Google)

How do I check that it works?

Run your domain through the SPF, DKIM and DMARC checker to confirm the three records exist and parse correctly. Then send a message to a Gmail address, open it, and choose Show original: Gmail lists the SPF, DKIM and DMARC result for that specific message, along with the DKIM selector used.

Once DMARC is live, the aggregate reports at your rua address show every source sending as your domain and whether it passed. That is the evidence you need before moving to quarantine or reject.