How to set up SPF, DKIM and DMARC for your domain (step by step)

WebsiteScanner · November 3, 2026 · about 8 min read · Tiếng Việt

Email was designed long before anyone worried about forgery, so the "From" line of a message can say anything. That is how a supplier receives an invoice "from" your accounts address asking them to pay a new bank account. SPF, DKIM and DMARC are three DNS records that let receiving mailboxes tell your real email from forgeries. They cost nothing; you add them in the DNS settings of your domain.

What each record does

SPF (Sender Policy Framework)

A TXT record at the root of your domain that lists which servers may send mail using your domain in the envelope sender. Receivers compare the sending server's IP address with that list.

DKIM (DomainKeys Identified Mail)

Your email provider signs each outgoing message with a private key. The matching public key is published in DNS under a selector, for example google._domainkey.example.com. If the message is altered in transit, the signature no longer verifies.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

A TXT record at _dmarc.example.com that sets a policy (none, quarantine or reject) for mail that fails, and an address for reports. The key detail: DMARC passes only when SPF or DKIM passes and is aligned with the domain in the visible From line. That is why SPF alone does not stop spoofing.

Step 1: See what you have now

Enter your domain in the email spoofing check to read your current SPF and DMARC records. Then send a message from your company mailbox to a Gmail address, open it and choose Show original: Gmail reports SPF, DKIM and DMARC as PASS or FAIL.

Step 2: List every service that sends as your domain

This is the step people skip. Besides your main mailbox, your domain may be used by:

• Google Workspace, Microsoft 365, or email included with your hosting.
• Newsletter and marketing tools.
• Invoicing, booking, e-commerce or CRM software that emails customers.
• Your website's contact forms and order notifications (for example WordPress or WooCommerce).
• Helpdesk and support tools.

Write each one down. Every service documents its own SPF and DKIM settings.

Step 3: Publish one SPF record

Add a TXT record with host @ (the root of the domain). Examples:

v=spf1 include:_spf.google.com ~all                  # Google Workspace only
v=spf1 include:spf.protection.outlook.com ~all       # Microsoft 365 only
v=spf1 include:_spf.google.com include:mail.example-esp.com ~all   # several services

• One SPF record per domain. Two records starting with v=spf1 make SPF fail with a permanent error. Merge the include: parts into one line.
• The 10-lookup limit. SPF evaluation may trigger at most 10 DNS lookups (include, a, mx, exists, redirect, including those nested inside includes). Going over also causes a permanent error. Remove services you no longer use before adding new ones.
• ~all means "anything else is suspicious", -all means "anything else fails". Never use +all.

The SPF & DMARC record builder lets you tick the services you use and copy a single correct record.

Step 4: Enable DKIM in each sending service

You can't write a DKIM record yourself, because the key pair is generated by your email provider. The usual flow: find the DKIM or "authenticate domain" setting in the service's admin area, copy the record it gives you (TXT or CNAME), add it to DNS, wait for it to propagate, then switch signing on.

• Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a key, publish it as a TXT record (selector google by default), then click Start authentication.
• Microsoft 365: DKIM is managed in the Microsoft Defender portal under the email authentication settings. Microsoft provides two CNAME records (selector1._domainkey and selector2._domainkey) to add before enabling signing. Menu names change over time, so follow Microsoft's current documentation.
• Marketing and business tools: usually offer a "domain authentication" page with ready-made CNAME records.

Because every provider picks its own selector, DKIM can't be checked from outside by knowing only the domain. WebsiteScanner's checker reads SPF and DMARC but does not test DKIM. Use Gmail's Show original to confirm DKIM = PASS.

Step 5: Start DMARC in monitoring mode

Add a TXT record with host _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

p=none blocks nothing. It asks receivers to send daily aggregate reports (XML files) to the rua address. Use a dedicated mailbox, and consider a DMARC report service (several have free tiers) to turn the XML into readable tables.

Step 6: Read the reports for a few weeks

Reports list every server that sent mail using your domain and whether it passed SPF and DKIM. You'll find two kinds of sources:

• Yours, but failing: a service you forgot in step 2. Add it to SPF or enable DKIM for it.
• Unknown: forgers using your domain — exactly what you want to block.

Step 7: Tighten to quarantine, then reject

Once all legitimate sources pass, tighten the policy in stages, watching reports for a week or two after each change:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

pct=25 applies the policy to a quarter of failing mail, a gentle first test. At p=reject, receivers that honour DMARC refuse forged mail from your domain.

Domains that never send email

Parked, spare or website-only domains can still be spoofed. Lock them down with:

@        TXT  v=spf1 -all
_dmarc   TXT  v=DMARC1; p=reject

Gmail and Yahoo sender requirements

Since February 2024, Google's email sender guidelines require all senders to Gmail accounts to set up SPF or DKIM, and require bulk senders — those sending roughly 5,000 or more messages a day to Gmail accounts — to set up SPF, DKIM and DMARC, with DMARC alignment and easy unsubscribe for marketing mail. Yahoo announced similar requirements at the same time. Check the providers' current guidelines for the exact rules. Even if you send far less, authenticated mail is less likely to land in spam.

Common mistakes

• Two SPF records, or the DMARC record placed at @ instead of _dmarc.
• Forgetting the website form or invoicing tool, so its mail is blocked once you reach p=reject.
• Leaving p=none forever: forged mail is still delivered.
• A DNS panel that adds quotes or appends the domain to the host name; re-check with the checker after saving.

Keep an eye on it

DNS records get edited when you change providers. WebsiteScanner's free scan includes SPF and DMARC alongside HTTPS and security headers, and after you verify you own the domain it re-scans weekly for free and emails you about new issues. WebsiteScanner PRO adds a deep scan (5,000+ checks for known vulnerabilities), deep re-scans up to 10 times a day and uptime checks every 5 minutes.

Frequently asked questions