SPF, DKIM and DMARC are three DNS records that prove your business emails are real. SPF lists the servers allowed to send for your domain, DKIM adds a digital signature to each message, and DMARC tells receiving servers what to do if SPF or DKIM fails. Together they protect your brand from spoofing and help your emails reach the inbox instead of spam.
If your business emails land in spam, or if customers have received fake messages that look like they came from you, the cause is often missing email authentication. The fix is not expensive. It takes three small DNS records and about an hour of careful setup.
Also readHow to Set Up Meta Business Agent on WhatsApp Business: A Step-by-Step Guide for Small Businesses
This guide explains SPF, DKIM and DMARC in plain English, shows what each record looks like, gives a step-by-step setup plan and includes a free email security checklist you can score yourself. If you are also tightening online safety, read our article on spotting a paid group scam and the basics in what a VPN does.
In this article
Why Email Authentication Matters in 2026
- Spoofing is easy. Without protection, anyone can send a message that appears to come from your domain.
- Inbox providers expect it. Since early 2024, Google and Yahoo have required SPF, DKIM and DMARC from bulk senders, and authenticated mail is treated as more trustworthy for everyone else too.
- It protects customers. Fake invoices and phishing emails that borrow your name damage trust.
- It improves delivery. Properly authenticated email is less likely to be filtered as spam.
SPF, DKIM and DMARC at a Glance
| Record | What it does | Simple analogy |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | A guest list at the door |
| DKIM | Adds a cryptographic signature that proves the message was not altered | A tamper-proof seal on an envelope |
| DMARC | Tells receivers what to do when checks fail and sends you reports | The rule for what the doorman does with uninvited guests |
What Is SPF?
SPF stands for Sender Policy Framework. It is a TXT record in your domain’s DNS settings that names the mail servers and services allowed to send email for you. A receiving server looks up the record and checks whether the sending server is on the list.
A simple SPF record for a business using Google Workspace looks like this: v=spf1 include:_spf.google.com ~all. The include part authorises Google’s servers, and ~all means “soft fail” for anything else. Add one include for each service that sends email on your behalf, such as your newsletter platform, invoicing tool or CRM.
What Is DKIM?
DKIM stands for DomainKeys Identified Mail. Your email service signs every outgoing message with a private key, and you publish the matching public key in DNS. The receiving server uses the public key to check that the signature is valid and the message was not changed on the way.
You do not create the keys by hand. Your email provider generates them and gives you a record to add to DNS, usually a TXT or CNAME record. Each sending service, such as your main mailbox provider and your newsletter tool, needs its own DKIM setup.
What Is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It sits on top of SPF and DKIM. It tells receiving servers what to do when a message fails authentication and where to send reports about it.
There are three policies:
- none: only monitor and send reports. Safe for a first setup.
- quarantine: send failing messages to spam.
- reject: block failing messages completely.
A starter DMARC record is a TXT record on _dmarc.yourdomain.com with a value such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The rua address receives summary reports.
How to Set Up SPF, DKIM and DMARC Step by Step
Step 1: List every service that sends email for you
Include your main mailbox provider, website contact forms, newsletter tool, invoicing software, helpdesk and CRM. Missing a service is the most common reason legitimate emails fail later.
Step 2: Create or update your SPF record
Open your domain’s DNS settings at your registrar or host. Create one TXT record that includes every sender. Keep it to a single record.
Step 3: Turn on DKIM in each service
In each tool’s admin settings, look for “domain authentication” or “DKIM”. Copy the record it provides into your DNS and then click verify.
Step 4: Publish a DMARC record with p=none
Start in monitoring mode. Create a mailbox just for reports so your main inbox is not flooded.
Step 5: Read the reports for two to four weeks
Reports show who is sending email using your domain. You will usually discover a forgotten service that needs to be added to SPF or DKIM.
Step 6: Tighten the policy
When all legitimate sources pass, move to p=quarantine, then later to p=reject. Do this slowly and watch for problems.
Step 7: Test
Send test emails to Gmail and Outlook, open the message headers and look for “pass” next to SPF, DKIM and DMARC. Free online DNS and email-header checkers can also confirm your records.
Email Security Checklist Score
Tick what you have already done. Nothing is stored or sent anywhere.
- Check your DNS settings and email provider’s admin page.
- Tick every item you have completed.
- Follow the advice under the score.
Common Problems and Fixes
- Two SPF records: merge them into one.
- Too many lookups: remove unused includes, because SPF allows a maximum of ten DNS lookups.
- Forwarded emails fail SPF: this is normal; DKIM is what lets forwarded messages still pass DMARC.
- Newsletter emails fail DMARC: the tool is not set up with your domain's DKIM. Complete its domain authentication.
- Reports are unreadable: they arrive as compressed XML files; a free DMARC report viewer makes them easy to read.
- Changes not showing: DNS updates can take from minutes to a day to spread.
Who Should Do This First?
Every business with its own domain should, but the need is greatest if you send invoices, run an online store, send newsletters or handle customer data. If you use AI assistants or automated agents to answer customers, make sure their emails are authenticated too; see our guides on AI tool budgets for small business and how to set up a Meta business agent.
Frequently Asked Questions
Do I need all three of SPF, DKIM and DMARC?
Yes. Each does a different job, and DMARC depends on SPF and DKIM. Together they give the strongest protection and the best delivery.
Will DMARC stop my emails from being delivered?
Not if you start with p=none, which only monitors. Move to quarantine or reject only after you confirm that all legitimate services pass.
Where do I add these records?
In your domain's DNS settings, at your registrar or hosting provider, as TXT or CNAME records as instructed by your email service.
How do I know if it is working?
Send a test email and view the full headers in Gmail or Outlook. Look for pass results for SPF, DKIM and DMARC.
Is this required by Google and Yahoo?
Large bulk senders have been required to authenticate with SPF, DKIM and DMARC since early 2024. Even smaller senders benefit, and rules can change, so check the current provider guidelines.
Final Thoughts
Email authentication is one of the cheapest security upgrades a business can make. Set up SPF and DKIM, add DMARC in monitoring mode, read the reports and tighten gradually. Use the checklist above to track your progress, and verify exact record syntax in your email provider's official documentation, because services differ.
Explore More on BusinessToMark
- 100% free
- Call direct
- Voice search
- Urdu & English