SecurityUpdated Feb 2026

How to Set Up DMARC, SPF & DKIM: Stop Email Spoofing

Email spoofing costs businesses billions annually. Without proper authentication, anyone can send emails pretending to be your domain. This guide walks you through configuring SPF, DKIM, and DMARC, the three DNS records that prove your emails are legitimate.

Mallory Keegan

Web hosting enthusiast who tests providers and breaks down features, pricing, and real world speed

SPF, DKIM, and DMARC: the three DNS records that stop email spoofing

Why Email Authentication Matters

Email was designed in the 1970s without built-in sender verification. By default, any mail server can claim to send from any domain. SPF, DKIM, and DMARC are the three protocols that fix this fundamental flaw.

Without Authentication	With SPF + DKIM + DMARC
Anyone can spoof your domain	Only authorized servers can send as you
Phishing emails reach your customers	Spoofed emails are rejected or quarantined
10–30% of emails land in spam	95%+ inbox placement rate
No visibility into email abuse	Daily reports on authentication results
Brand reputation at risk	Domain reputation protected
Non-compliant with Google/Yahoo rules	Meets all sender requirements

Google's sender requirements (2024+): All bulk senders (5,000+ emails/day to Gmail) must have SPF and DKIM configured, with DMARC strongly recommended. Non-compliant senders face rate limiting and spam folder placement. Yahoo enforces similar rules.

How Email Spoofing Works

Understanding the attack helps you appreciate why three separate protocols are needed. Email has two "From" addresses, and attackers exploit both:

Concept	What It Is	Protected By
Envelope From (MAIL FROM)	The return-path address used by mail servers	SPF
Header From (From:)	The address displayed to the recipient	DKIM + DMARC
Message Body	The email content including links	DKIM signature
Domain Alignment	Ensuring envelope and header domains match	DMARC

A spoofing attack works by connecting to any SMTP server and typing MAIL FROM: ceo@yourdomain.com. Without SPF, the receiving server has no way to verify if the sender is authorized. Without DKIM, it can't verify the message wasn't altered. Without DMARC, it doesn't know what to do with suspicious emails.

SPF: Sender Policy Framework

SPF tells receiving mail servers which IP addresses are authorized to send email from your domain. It's a single DNS TXT record published at your domain root.

How SPF Works

1You publish a TXT record listing authorized sending IPs/servers

2Receiving server checks the sender's IP against your SPF record

3If the IP is listed → SPF passes. If not → SPF fails

4The result is used by DMARC to make a final accept/reject decision

SPF Record Syntax

v=spf1 ip4:192.0.2.0/24 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all

Mechanism	Meaning	Example
v=spf1	SPF version (always v=spf1)	Required, must be first
ip4:	Authorize specific IPv4 address/range	ip4:203.0.113.5
ip6:	Authorize specific IPv6 address/range	ip6:2001:db8::/32
include:	Include another domain's SPF record	include:_spf.google.com
a	Authorize the domain's A record IPs	a (current domain)
mx	Authorize the domain's MX record IPs	mx (mail servers)
-all	Hard fail, reject unauthorized senders	Strictest (recommended with DMARC)
~all	Soft fail, mark but don't reject	Safer during initial setup
?all	Neutral, no policy	Not recommended

Common Service Include Statements

Service	SPF Include
Google Workspace	include:_spf.google.com
Microsoft 365	include:spf.protection.outlook.com
SendGrid	include:sendgrid.net
Mailgun	include:mailgun.org
Mailchimp	include:servers.mcsv.net
Amazon SES	include:amazonses.com
Postmark	include:spf.mtasv.net
HubSpot	include:hubspot.com
Zendesk	include:mail.zendesk.com
Freshdesk	include:email.freshdesk.com

10-lookup limit: SPF allows a maximum of 10 DNS lookups. Each include: counts as 1+ lookups (nested includes add up). If you exceed 10, SPF returns permerror and fails. Use SPF flattening tools to resolve includes into IP addresses if you hit the limit.

DKIM: DomainKeys Identified Mail

DKIM adds a cryptographic signature to every outgoing email. The receiving server verifies this signature against a public key in your DNS records. If the signature is valid, it proves the email hasn't been tampered with and was sent by an authorized server.

How DKIM Works

1Your mail server signs outgoing emails with a private key

2The signature is added as a DKIM-Signature header in the email

3You publish the corresponding public key as a DNS TXT record

4The receiving server uses the public key to verify the signature

5If valid → DKIM passes, proving the email is authentic and unaltered

DKIM DNS Record Format

Record Name: selector1._domainkey.yourdomain.com

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1234...publickey...5678

Tag	Required	Meaning
v=DKIM1	Yes	DKIM version identifier
k=rsa	No (default rsa)	Key type, RSA is standard, Ed25519 is newer
p=	Yes	Base64-encoded public key
t=s	No	Strict mode, subdomain must exactly match
t=y	No	Testing mode, don't enforce failures

DKIM Key Sizes

Key Size	Security	DNS Compatibility	Recommendation
1024-bit RSA	Minimum acceptable	Fits in single TXT record	Legacy, upgrade when possible
2048-bit RSA	Strong	May need split TXT record	Recommended standard
Ed25519	Very strong, compact	Always fits single record	Emerging, not universally supported yet

DMARC: Domain-based Message Authentication

DMARC ties SPF and DKIM together. It tells receiving servers what to do when authentication fails and sends you reports about who's sending email from your domain; both legitimate and fraudulent.

DMARC Record Syntax

Record Name: _dmarc.yourdomain.com

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensic@yourdomain.com; pct=100; adkim=r; aspf=r

Tag	Required	Values	Meaning
v=DMARC1	Yes	DMARC1	Version, must be first tag
p=	Yes	none / quarantine / reject	Policy for failing emails
rua=	No*	mailto:address	Where to send aggregate reports (daily XML)
ruf=	No	mailto:address	Where to send forensic (failure) reports
pct=	No	1–100 (default 100)	Percentage of emails to apply policy to
adkim=	No	r (relaxed) / s (strict)	DKIM alignment mode
aspf=	No	r (relaxed) / s (strict)	SPF alignment mode
sp=	No	none / quarantine / reject	Policy for subdomains
fo=	No	0 / 1 / d / s	Forensic report options

DMARC Policy Progression

Phase	Policy	Duration	What Happens
1. Monitor	p=none	2–4 weeks	No emails blocked. You receive reports to audit all sending sources.
2. Soft Enforce	p=quarantine; pct=25	2 weeks	25% of failing emails go to spam. Watch for false positives.
3. Increase	p=quarantine; pct=100	2 weeks	All failing emails go to spam. Verify no legitimate email is affected.
4. Full Reject	p=reject	Permanent	Spoofed emails are rejected entirely. Maximum protection.

Implementation Order & Timeline

Week	Task	Details
Week 0	Audit all sending sources	List every service sending from your domain: mail server, CRM, helpdesk, newsletter, transactional email, marketing automation
Week 1	Publish SPF record	Add TXT record with all authorized senders. Use ~all (soft fail) initially. Validate with MXToolbox.
Week 1	Configure DKIM for each service	Generate key pairs, publish public keys as DNS TXT records. Each service gets a unique selector.
Week 1	Publish DMARC with p=none	Start monitoring. Set rua= to receive aggregate reports. Use a DMARC report analyzer.
Week 2–3	Review DMARC reports	Identify any legitimate senders missing from SPF/DKIM. Fix alignment issues.
Week 4	Move to p=quarantine (pct=25)	25% of failing emails go to spam. Monitor for false positives.
Week 5–6	Increase to pct=100	All failing emails quarantined. Verify no legitimate email affected.
Week 7–8	Move to p=reject	Full protection. Spoofed emails blocked entirely. Change SPF to -all.

Complete DNS Record Examples

Here are production-ready DNS records for common setups. Replace yourdomain.com with your actual domain.

Google Workspace + Mailchimp

SPF (TXT record at @)

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

DKIM (TXT at google._domainkey)

v=DKIM1; k=rsa; p=MIIBIjANBg... (from Google Admin Console)

DMARC (TXT at _dmarc)

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r

Microsoft 365 + SendGrid

SPF (TXT record at @)

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all

DKIM, Microsoft (CNAME records)

selector1._domainkey → selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
selector2._domainkey → selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

DMARC (TXT at _dmarc)

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc-forensic@yourdomain.com; pct=100

Self-Hosted (Postfix/Dovecot) + Amazon SES

SPF (TXT record at @)

v=spf1 ip4:203.0.113.10 include:amazonses.com -all

DKIM for self-hosted (TXT at mail._domainkey)

v=DKIM1; k=rsa; p=MIIBIjANBg... (generated via opendkim-genkey)

DMARC (TXT at _dmarc)

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

Testing & Validation Tools

Tool	Cost	Tests	Best For
MXToolbox	Free	SPF, DKIM, DMARC lookups	Quick DNS record validation
mail-tester.com	Free (3/day)	Full email deliverability score	Testing actual sent emails
Google Postmaster Tools	Free	Domain reputation, auth rates	Gmail-specific deliverability
dmarcian	Free tier	DMARC reports, SPF analysis	Ongoing DMARC monitoring
DMARC Analyzer (Mimecast)	Paid	Reports, alerting, forensics	Enterprise DMARC management
Postmark DMARC Digests	Free	Weekly DMARC report summaries	Simple, no-setup monitoring
dig / nslookup (CLI)	Free	Raw DNS queries	Developer debugging

Quick CLI validation commands:

# Check SPF record
dig TXT yourdomain.com +short | grep spf

# Check DKIM record
dig TXT selector1._domainkey.yourdomain.com +short

# Check DMARC record
dig TXT _dmarc.yourdomain.com +short

# Full email test (send to this address and check results)
# mail-tester.com, provides a unique address per test

Common Mistakes to Avoid

❌ Multiple SPF records

✅ You can only have ONE SPF TXT record per domain. Combine all includes into a single record. Multiple records cause permerror.

❌ Exceeding 10 DNS lookups in SPF

✅ Count all include: and redirect= mechanisms (including nested ones). Use SPF flattening tools or replace includes with ip4: where possible.

❌ Jumping straight to DMARC p=reject

✅ Always start with p=none for 2–4 weeks. Review aggregate reports to identify all legitimate senders before enforcing.

❌ Forgetting third-party senders

✅ Audit all services: CRM (HubSpot, Salesforce), helpdesk (Zendesk), newsletters (Mailchimp), transactional (SendGrid). Each needs SPF include and DKIM.

❌ Not setting up DMARC reports (rua=)

✅ Without rua=, you have zero visibility into authentication results. Use a free service like Postmark DMARC Digests or dmarcian.

❌ Using 512-bit or 768-bit DKIM keys

✅ These are crackable. Minimum 1024-bit, recommended 2048-bit RSA. Most services now generate 2048-bit by default.

❌ Forgetting subdomain policy (sp=)

✅ Without sp=, subdomains inherit the main domain's DMARC policy. Set sp=reject if you don't send email from subdomains.

❌ Not testing after DNS changes

✅ Always verify with MXToolbox and send test emails to Gmail, Outlook, and Yahoo after making changes. Check headers for pass/fail.

Email Hosting Provider Support

Provider	SPF	DKIM	DMARC	Setup Difficulty
Google Workspace	Auto-configured	Manual (Admin Console)	Manual DNS	Easy
Microsoft 365	Auto-configured	Auto (Exchange Online)	Manual DNS	Easy
Zoho Mail	Manual DNS	Manual (Admin)	Manual DNS	Moderate
Fastmail	Auto-configured	Auto-configured	Manual DNS	Easy
Postfix (self-hosted)	Manual DNS	Manual (opendkim)	Manual DNS	Advanced
cPanel / Plesk	Built-in tool	Built-in tool	Manual DNS	Easy
Amazon SES	Manual DNS	Auto (SES Console)	Manual DNS	Moderate
SendGrid	Manual DNS	Auto (Settings)	Manual DNS	Easy

Ongoing Monitoring & DMARC Reports

DMARC aggregate reports (rua) are XML files sent daily by receiving mail servers. They contain authentication results for every email sent from your domain. Without parsing these reports, you're flying blind.

Report Field	What It Tells You	Action If Failing
Source IP	Which server sent the email	Check if it's a legitimate service you forgot to authorize
SPF result	Pass, fail, softfail, neutral	Add missing include: or ip4: to SPF record
DKIM result	Pass or fail	Verify DKIM key is published and signing is enabled
DKIM alignment	Relaxed or strict match	Ensure From: domain matches DKIM d= domain
SPF alignment	Relaxed or strict match	Ensure envelope From matches header From domain
Disposition	None, quarantine, reject	Indicates what the receiver did with the email
Message count	Volume from each source	High volume from unknown IPs = potential spoofing

Free monitoring: Use Postmark's free DMARC Digests (dmarc.postmarkapp.com) to receive weekly human-readable summaries instead of raw XML. Simply set rua=mailto:youruniqueid@dmarc.postmarkapp.com in your DMARC record.

Implementation Checklist

Step	Priority	Verification
List all services sending from your domain	Critical	Check sent folders, ask marketing/sales/support teams
Publish SPF record with all authorized senders	Critical	dig TXT yourdomain.com, verify v=spf1 present
Verify SPF has ≤10 DNS lookups	Critical	Use MXToolbox SPF checker, must show ≤10 lookups
Enable DKIM signing on primary mail server	Critical	Send test email, check DKIM-Signature header
Configure DKIM for all third-party senders	Critical	Each service has unique selector + DNS record
Publish DMARC record with p=none	Critical	dig TXT _dmarc.yourdomain.com, verify record exists
Set up DMARC report receiving (rua=)	High	Receive first aggregate report within 24–48 hours
Send test emails to Gmail, Outlook, Yahoo	High	Check email headers for SPF=pass, DKIM=pass, DMARC=pass
Run mail-tester.com score check	High	Score should be 9/10 or higher
Review DMARC reports for 2–4 weeks	High	Identify and fix any legitimate senders failing auth
Move DMARC to p=quarantine	Medium	Monitor bounce rates for false positives
Move DMARC to p=reject	Medium	Final protection, spoofed emails fully blocked
Set subdomain policy (sp=reject)	Medium	Prevents spoofing from subdomains
Document all DNS records and sending services	Medium	Maintain runbook for future changes

Frequently Asked Questions

What happens if I don't set up SPF, DKIM, and DMARC?

Without email authentication, anyone can send emails pretending to be from your domain. Your legitimate emails are more likely to land in spam folders. Google and Yahoo now require SPF and DKIM for bulk senders (5,000+ emails/day), and DMARC is strongly recommended. Without these, expect 10–30% lower inbox placement rates.

Can SPF, DKIM, and DMARC break my existing email?

Yes, if configured incorrectly. The biggest risk is forgetting to include all your legitimate sending services in SPF (e.g., your CRM, newsletter tool, helpdesk). Start DMARC with p=none (monitor only) for 2–4 weeks to identify all sending sources before enforcing. Never jump straight to p=reject.

How long does it take for DNS changes to propagate?

DNS propagation typically takes 15 minutes to 48 hours, though most changes are visible within 1–4 hours. TTL (Time To Live) values on your existing records affect this, lower TTL values mean faster propagation. Set TTL to 300 (5 minutes) before making changes, then increase after verification.

Do I need DMARC if I already have SPF and DKIM?

SPF and DKIM alone don't tell receiving servers what to do with failing emails. DMARC provides that missing policy layer, it instructs servers to quarantine or reject spoofed emails and sends you reports about authentication failures. Without DMARC, spoofed emails may still reach inboxes even with SPF/DKIM in place.

What's the difference between DMARC p=none, p=quarantine, and p=reject?

p=none monitors only, no emails are blocked, but you receive reports. p=quarantine sends failing emails to spam/junk folders. p=reject blocks failing emails entirely. Always start with p=none, move to p=quarantine after 2–4 weeks of clean reports, then p=reject after another 2–4 weeks. This phased approach prevents accidental blocking of legitimate email.

How many DNS lookups can SPF have?

SPF has a hard limit of 10 DNS lookups per evaluation. Each 'include:' and 'redirect=' counts as one lookup, and nested includes count toward the total. Exceeding 10 lookups causes SPF to fail with a 'permerror.' Use SPF flattening tools (like dmarcian or AutoSPF) if you have many sending services.

Does email authentication affect email deliverability?

Yes, significantly. Properly configured SPF + DKIM + DMARC can improve inbox placement by 10–30%. Gmail, Yahoo, Microsoft, and Apple all use authentication signals in spam filtering. Google's 2024 sender requirements made SPF/DKIM mandatory for bulk senders, with DMARC strongly recommended.

Can I use the same DKIM key for multiple services?

No. Each sending service (your mail server, newsletter tool, CRM, etc.) should have its own DKIM key pair with a unique selector. This allows you to revoke one key without affecting others and makes troubleshooting easier. Most email services provide their own DKIM keys; you just need to add their DNS records.

Need Hosting with Built-in Email Authentication?

The best hosting providers include SPF, DKIM, and DMARC tools built into their control panels. Find the right host for your email security needs.

Find Email-Friendly Hosting