Setting up SPF, DKIM and DMARC without an IT department

If your emails land in spam, it is usually not what you wrote. It is that the receiving server cannot verify you are allowed to send from your own domain, so it assumes you might not be.

What the three records do

They are DNS records, which means they live with whoever manages your domain, not inside your email software. Each answers a different question.

• SPF lists which servers are allowed to send email using your domain. It answers "did this come from a machine you approved".
• DKIM adds a cryptographic signature to each message. It answers "was this altered in transit, and does it really come from you".
• DMARC tells receiving servers what to do when SPF or DKIM fails, and where to send reports. It answers "and if the answer is no, then what".

Without all three, large providers increasingly treat your mail as suspicious. Gmail, Yahoo and Outlook now set firm rules for senders, covered further down, and the direction of travel is one way.

The order to do it in

SPF first, DKIM second, DMARC last. DMARC without the other two in place will start failing messages you actually sent, which is a bad afternoon.

SPF

One TXT record on your domain, listing every service that sends email as you. That usually means your email provider, and separately your newsletter tool, your website contact form, and anything that sends invoices or booking confirmations.

The most common mistake is forgetting one. If your accounting software emails invoices from your address, it belongs in the record. You are allowed only one SPF record on a domain, so everything goes in the same line.

DKIM

Your email provider generates the key and gives you a record to add. In Google Workspace and Microsoft 365 this is a short walk through a settings page. Your newsletter platform will have its own, separate from the main one, and it needs adding too.

DMARC

Start permissive and tighten. Publish a record with the policy set to none, which changes nothing about delivery but starts sending you reports. Read them for a few weeks, confirm everything legitimate is passing, then move the policy to quarantine and later to reject.

Going straight to reject is the mistake that causes a business to lose a fortnight of invoices.

Where to actually type these

In the DNS settings of whoever manages your domain. If you bought the domain from Cloudflare, GoDaddy or 123-Reg, it is there. If someone built your website, they may control it, in which case ask them.

Changes take anywhere from a few minutes to a few hours to take effect. Nothing is broken if it has not worked after ten minutes.

How to check it worked

Send an email to a Gmail address you control. Open it, choose "show original", and look for three lines reading SPF pass, DKIM pass and DMARC pass. Anything other than pass tells you which record to revisit.

What Gmail, Yahoo and Outlook now expect

Everyone sending to Gmail or Yahoo, however small, needs at least SPF or DKIM. Larger senders face a longer list. A newsletter to a few hundred people is well under the thresholds, but the list is still the clearest description of what good looks like.

Alignment means the domain in your From address matches the domain that passed SPF or DKIM. This is why your newsletter tool's own DKIM record matters. Until you add it, many tools sign your mail with their domain rather than yours.

A worked example

Imagine a business on example.com that uses Google Workspace for email and a separate newsletter tool. Its records would look like this. In most DNS settings, @ means the domain itself.

On Microsoft 365, the SPF include is include:spf.protection.outlook.com instead. Only add an include for the newsletter tool if its help pages ask for one. Some need just DKIM.

Now suppose the first reports show invoices from the accounting software failing DKIM. Fix that first. Once everything you recognise passes, change p=none to p=quarantine. Wait a few more weeks, then change it to p=reject.

Reading DMARC reports without the headache

Reports arrive as zipped data files written for computers, usually daily from each large provider. These free tools turn them into something readable, and each supplies the address for the rua part of your record, which says where reports go:

• Postmark's DMARC Digests sends a free weekly summary email. The free version shows your top ten sending sources.
• Cloudflare DMARC Management is free if your domain's DNS is on Cloudflare.

Separately, Google Postmaster Tools shows your Gmail spam complaint rate and whether you meet Google's requirements. At low volumes it may show little or no data.

Each sender listed in a report falls into one of three groups:

• A service you recognise, passing. Nothing to do.
• A service you recognise, failing. Fix its SPF or DKIM before you tighten the policy.
• A source you do not recognise. Ask colleagues first, in case someone added a tool without saying. If not, it is likely forwarded mail or someone sending as you. Stopping the second is what quarantine and reject are for.

The UK's National Cyber Security Centre (NCSC) advises watching reports for at least two weeks before moving on from p=none.

Mistakes to avoid

• Too many includes. SPF allows no more than ten DNS lookups. Each include counts, along with any lookups inside it. Go over and SPF fails for all your mail, not just the last service added.
• Ending SPF with +all. It authorises every server on the internet to send as you.
• Stopping at p=none. It meets the bulk sender rules, but it does not stop anyone pretending to be you.
• Forgetting domains you never send from. A spare .com bought to protect your .co.uk can still be used to fake email. The NCSC suggests v=spf1 -all and a DMARC record at p=reject for these.
• Sending reports to a mailbox nobody reads. If you would rather not read them at all, this setup is part of our email marketing service.

Why this matters more than the copy

A well written newsletter that lands in spam performs worse than a mediocre one that lands in the inbox. Authentication is unglamorous, takes an afternoon, and is the single highest return thing most small businesses can do to their email.

It is also the step most agencies skip, because it happens in DNS rather than in the design, and nobody can see it in a proposal.

---

All insights →