binfield guides

guide

How to set up SPF, DKIM and DMARC.

These three records stop other people sending fake email as you, and help your real email reach the inbox instead of spam. Here is what each does and how to add them.

What each one does

RecordIn plain English
SPFA list of the servers allowed to send email for your domain.
DKIMA signature added to each email so receivers can tell it was not changed on the way.
DMARCThe rule that says what to do with email that fails SPF or DKIM, and where to send reports.

You need all three. Large mailbox providers expect them from anyone who sends in bulk, and they improve delivery for everyone else.

Step 1: SPF

SPF is one TXT record on your domain. It names every service that sends your email. For example, if you use Google Workspace:

v=spf1 include:_spf.google.com ~all
  • You can only have one SPF record. Two records make both invalid. Merge them into one.
  • SPF allows at most 10 DNS lookups in total. Too many include: entries break it.
  • Ending in ~all means “soft fail”. -all means reject. Start with ~all.
  • Add every service that sends as you: your mailbox provider, newsletter tool, invoicing software.

Step 2: DKIM

Your email provider creates the key. In its settings, find “DKIM” or “domain authentication”. It gives you a name and a value to publish as a DNS record, usually a TXT or CNAME record at a name ending ._domainkey. Add it, then press verify in the provider.

DKIM is hard to check from outside because the first part of the name (the selector) is chosen by your provider. A checker can look for common selectors, but “not found” does not prove it is missing.

Step 3: DMARC

DMARC is a TXT record at _dmarc.yourdomain. Start by only watching:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk

Reports arrive at the address in rua. Once you are sure all your real email passes, move the policy to p=quarantine (send failures to spam), and later to p=reject (block them). Do not jump straight to reject: you may block your own invoices.

Step 4: check it

Run the SPF and DMARC checker. It shows your SPF record, counts the lookups, reads your DMARC policy and looks for common DKIM selectors. Fix anything it marks, then check again.

See your SPF, DKIM and DMARC records and what to fix, in plain English.

Check your email setup

questions

Good to know

Do I need all three of SPF, DKIM and DMARC?

Yes. They work together. SPF and DKIM prove an email is genuine, and DMARC tells receivers what to do when it is not.

Why is my DKIM not found?

The checker can only guess common selector names. If your provider uses a custom one, it will not be found even though DKIM is working.

What DMARC policy should I use?

Start with p=none to watch, then move to quarantine and finally reject once your reports are clean.

$ ls related

$ mail

SPF and DMARC checker

Is your email set up to stop fakes?open →$ whois

Domain checker

Owner, DNS, hosting, email, security and uptime in one report.open →$ read

What is DNS? Records explained in plain English

DNS is the internet’s address book. It turns the name people type into the address of the server that…open →

Want us to do it for you?

Tell us what you need. We reply to every enquiry within 2 working days.

Make an enquiryEmail us