How to set up SPF, DKIM and DMARC (without the headache)

If you send email from your own domain, three DNS records quietly decide whether receiving servers trust you: SPF, DKIM and DMARC. Since 2024, large mailbox providers such as Gmail and Yahoo require them for bulk senders, and they increasingly use them to judge everyone else too. The good news: you set them up once, and they take about ten minutes.

The short version

• SPF lists which servers are allowed to send mail for your domain.
• DKIM adds a cryptographic signature to every message, proving it wasn’t altered and really came from your domain.
• DMARC tells receivers what to do when a message fails SPF and DKIM, and where to send reports.

Think of SPF as the guest list, DKIM as the wax seal on the envelope, and DMARC as the instructions for the doorman.

SPF: who may send for your domain

SPF is a single TXT record at the root of your domain. It starts with v=spf1, lists the allowed senders, and ends with a rule for everyone else.

v=spf1 mx include:_spf.example-provider.com ~all

• mx allows the servers in your MX records.
• include: pulls in another provider’s list (for example your email host or a helpdesk tool).
• ~all (soft fail) marks everything else as suspicious; -all (hard fail) says reject it.

Common SPF mistakes

1. Two SPF records. A domain may have only one record starting with v=spf1. If you use several services, merge them into one record with multiple include: entries.
2. Too many lookups. SPF allows at most 10 DNS lookups. Every include:, a and mx counts. Remove services you no longer use.
3. Forgetting a sender. Invoicing tools, CRMs and website contact forms that send “from” your domain need to be included or use their own domain.

DKIM: a signature on every message

With DKIM, your mail server signs each outgoing message with a private key. You publish the matching public key in DNS under a “selector”:

selector._domainkey.yourcompany.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

Receivers fetch the public key and check the signature. If the message was altered in transit, or wasn’t signed by your server, the check fails.

Your email provider generates the key pair; you only publish the public part. In VoraMail, the setup wizard shows the exact host and value, and outgoing mail is signed automatically.

Paste DKIM values exactly, as one line. Some DNS panels split long TXT values into chunks automatically; that’s fine. Adding extra quotes or spaces is not.

DMARC: the policy and the reports

DMARC ties SPF and DKIM to the address people actually see in the From line (this is called alignment) and tells receivers what to do with failures.

_dmarc.yourcompany.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com"

• p=none monitors only, p=quarantine sends failures to spam, p=reject blocks them.
• rua= is where aggregate reports are sent: daily XML summaries of who is sending as your domain.

A sensible rollout

1. Start with p=none and a reporting address for a week or two.
2. Check the reports (or a free DMARC report viewer) to make sure every legitimate sender passes.
3. Move to p=quarantine, then p=reject once you’re confident.

If you only send through one provider that handles SPF and DKIM for you, starting at quarantine is reasonable.

How to check your setup

• Send an email to a Gmail address, open it, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS.
• Use a DNS lookup tool to confirm the records are published.
• Monitor continuously: records get lost when you change registrar, move your website, or add a new tool. VoraMail’s domain health monitor checks MX, SPF, DKIM, DMARC and major blocklists every few hours and emails you when something breaks.

Summary

Set them up once, keep an eye on them, and you’ve handled the most important part of email deliverability.