SPF, DKIM, and DMARC work together to prevent email spoofing and improve deliverability. This guide walks through setting up all three with verification at each step.
Add a TXT record at your domain's root with your mail provider's include directives. For example, if you use Google Workspace and Amazon SES:
v=spf1 include:_spf.google.com include:amazonses.com -all
Each service that sends mail on your behalf needs its own include: directive. The SPF specification limits you to 10 DNS lookups per evaluation, and each include: counts as at least one. If you exceed this limit, SPF evaluation will fail with a permerror.
Verify by opening the DNS tool and checking the TXT records for your domain. You should see your SPF record in the results.
Enable DKIM in your mail provider's admin panel. They will give you a DNS record to publish, usually a CNAME or TXT record at selector._domainkey.yourdomain.com. Each provider uses a different selector name (Google uses google, Amazon SES generates a unique string, etc.).
Add the record to your DNS, then verify by looking up selector._domainkey.yourdomain.com in the DNS tool. The record should contain a public key starting with v=DKIM1.
Add a TXT record at _dmarc.yourdomain.com. Start with monitoring mode so you can observe without blocking any email:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
The p=none policy tells receiving servers to send reports but take no action on failures. The rua tag specifies where aggregate reports should be sent.
Verify by looking up _dmarc.yourdomain.com in the DNS tool.
Wait 1-2 weeks for aggregate reports to arrive at your rua address. These XML reports show which IP addresses sent mail using your domain and whether they passed SPF and DKIM checks.
Look for legitimate senders that are failing alignment. Common findings: a SaaS tool you forgot to add to SPF, a DKIM selector that was not published, or forwarded mail that breaks SPF. Add missing include: directives or DKIM records for each legitimate sender.
Once reports show all legitimate mail is passing both SPF and DKIM alignment, update your DMARC record to quarantine mode:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com
This sends failing messages to the recipient's spam folder. Monitor reports for another 1-2 weeks. If no legitimate mail is being quarantined, move to the strictest policy:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com
With p=reject, receiving servers will drop messages that fail alignment entirely.
Run a final check with the DNS tool. Confirm all three records are present: SPF TXT record at the domain root, DKIM record at each selector, and DMARC TXT record at _dmarc. Use the Health Check tool for a full audit that validates syntax and identifies common misconfigurations.
include: directives can nest. An include that itself includes three other domains counts as four lookups. Use an SPF flattening tool if you hit this limit.~all (softfail) instead of -all (hardfail) indefinitely. Softfail is reasonable during setup, but you should move to hardfail once your SPF record is complete.p=reject without monitoring. Forwarded mail often breaks SPF alignment. Without monitoring first, you may block legitimate messages that are being forwarded.