Skip to content

Guides

How to set up SPF, DKIM and DMARC, so nobody can spoof email in your name

What the three records do, how to set them up step by step and why your emails land in spam more often without them. With examples to copy.

Published 27 October 2026, 8 min read

Is my email domain protected against spoofing?Check it for free with our Email Security Check

The sender address of an email is as easy to fake as the return address on an envelope. Scammers use this to send invoices with changed bank details or links to fake login pages in the name of real companies. Three DNS records make sure recipients can recognise such fakes: SPF, DKIM and DMARC.

Our email security check shows within seconds whether your domain is protected.

Why this also affects your genuine emails

Since February 2024, Gmail and Yahoo require everyone who sends a lot of email to their users to have SPF, DKIM and DMARC in place. Even for small senders, the big providers treat missing records negatively. If customers complain that your quotes end up in their spam folder, this is one of the most common reasons.

SPF: who may send for you?

SPF (Sender Policy Framework) is a TXT record on your domain that lists all servers allowed to send email with your sender address. A typical record looks like this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
  • v=spf1 marks the record as SPF.
  • include: adds a provider’s servers. Your email provider gives you the exact value in its help pages.
  • ~all at the end means: all other servers are suspicious. With -all they are rejected outright.

Common mistakes:

  1. Two SPF records. Only one is allowed per domain. If you also use a newsletter service or a booking system that sends email, add its include: to the existing record.
  2. Forgotten services. If your online shop, CRM or invoicing software sends email with your address, they must be in the SPF record too.
  3. More than ten lookups. SPF allows at most ten DNS lookups. Every include: counts, and providers often nest further ones. If the limit is exceeded, the whole record is invalid.

DKIM: the digital signature

With DKIM (DomainKeys Identified Mail), your mail server signs every outgoing email with a secret key. You publish the matching public key as a DNS record. The recipient can use it to verify that the email really comes from you and was not altered on the way.

You always set up DKIM at your email provider, because that is where the key is created. In the admin area there is usually an item like “DKIM” or “Authenticate domain”. The provider then shows you one or more records to create at your domain provider, for example:

Name:   google._domainkey
Type:   TXT
Value:  v=DKIM1; k=rsa; p=MIIBIjANBgkqh…

With Microsoft 365 and some other providers, it is two CNAME records instead. After creating them, you usually still need to enable DKIM at the provider.

DMARC: the instruction to the recipient

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells the recipient what to do with emails that fail both checks. The record always lives under the name _dmarc:

Name:   _dmarc
Type:   TXT
Value:  v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com

The most important setting is p=, the policy:

Value What happens to spoofed emails
p=none Nothing, they are delivered. For monitoring only.
p=quarantine They go to the spam folder.
p=reject They are rejected and never arrive.

With rua= you specify an address to which large providers send daily reports. They show you which servers send email in your name, including ones you had forgotten about.

Follow this order

  1. Create SPF with all services that send email for you.
  2. Enable DKIM at your email provider and at newsletter services.
  3. Start DMARC with p=none and watch the reports for two to four weeks.
  4. Switch to p=quarantine once all genuine emails pass SPF or DKIM.
  5. Later switch to p=reject for full protection.

If you start straight away with p=reject, you risk losing your own emails, for example the order confirmations of a forgotten shop system.

What if my domain doesn’t send any email?

You should still protect it, because unused domains in particular are popular for spoofing. These two records are enough:

TXT  @        v=spf1 -all
TXT  _dmarc   v=DMARC1; p=reject

This tells all recipients: this domain never sends email, anything with this sender is fake.

Check that everything works

After creating the records, it takes a few minutes to a few hours, depending on the settings, until they are visible everywhere. Then the email security check shows whether everything is recognised correctly. You can also send yourself an email to a Gmail account and check via “Show original”: SPF, DKIM and DMARC should each say “PASS”.

Keep reading