SPF, DKIM, and DMARC: The Complete Setup Guide (2026)

Why Email Authentication Matters in 2026

Since February 2024, Google and Yahoo require SPF, DKIM, and DMARC for senders over 5,000 emails/day, and Microsoft followed in late 2024. Even low-volume senders see far better inbox placement with authentication configured.

• SPF — Prevents spoofing: specifies which servers are authorized to send from your domain
• DKIM — Prevents tampering: cryptographically signs each email so receivers verify it arrived unmodified
• DMARC — Enforces policy: tells ISPs what to do when email fails SPF or DKIM, and sends daily reports

SPF (Sender Policy Framework)

What SPF Does

When Gmail receives an email claiming to be from your domain, it performs a DNS lookup to find your SPF record. If the sending server's IP is on your authorized list, the email passes SPF. If not, it fails — signaling spam or spoofing.

SPF Record Syntax

DKIM (DomainKeys Identified Mail)

What DKIM Does

Your mail server signs every outbound email with a private key. The matching public key lives in your DNS. When Gmail receives your email, it fetches your public key and verifies the signature. DKIM survives email forwarding (unlike SPF), making it the more reliable authentication method.

DKIM Setup by Provider

Google Workspace

1. Google Admin console → Apps → Google Workspace → Gmail → Authenticate email
2. Select your domain → click Generate new record
3. Copy the TXT record (Name: google._domainkey.yourdomain.com) and add it to your DNS
4. Wait for propagation, then return and click Start authentication

Microsoft 365

1. Microsoft 365 Defender → Email & collaboration → Policies & rules → Threat policies → DKIM
2. Select your domain → click Enable
3. Add the two CNAME records Microsoft provides: selector1._domainkey and selector2._domainkey

DKIM Record Example

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

What DMARC Does

DMARC adds policy enforcement on top of SPF and DKIM. It tells ISPs: "If an email from my domain fails SPF and DKIM alignment, do this." It also enables daily aggregate reports from major ISPs showing who is sending email from your domain and whether they're passing authentication.

DMARC requires alignment — the domain in the From: header must match the domain that passed SPF or DKIM.

DMARC DNS Record

• Name/Host: _dmarc (resolves to _dmarc.yourdomain.com)
• Type: TXT

DMARC Policy Progression — Never Skip Stages

Where to Add DNS Records: Provider Guide

Cloudflare

1. Dashboard → your domain → DNS → Records → Add record
2. SPF: Type=TXT, Name=@, Content=your SPF value
3. DMARC: Type=TXT, Name=_dmarc, Content=your DMARC value
4. DKIM: Type=TXT, Name=selector._domainkey, Content=DKIM value
5. Set Proxy status to DNS only (gray cloud) for all mail records
6. Propagation: 1–5 minutes

GoDaddy

1. My Products → Domains → your domain → DNS → ADD
2. SPF: Type=TXT, Name=@, Value=SPF record, TTL=1 hour
3. DMARC: Type=TXT, Name=_dmarc, Value=DMARC record
4. DKIM: Type=TXT, Name=selector._domainkey, Value=DKIM value
5. Propagation: 1–2 hours

Namecheap

1. Domain List → Manage → Advanced DNS → ADD NEW RECORD
2. SPF: Type=TXT Record, Host=@, Value=SPF record
3. DMARC: Type=TXT Record, Host=_dmarc, Value=DMARC record
4. DKIM: Type=TXT Record, Host=selector._domainkey, Value=DKIM value
5. Propagation: 30 min to 2 hours

Google Domains / Squarespace Domains

1. domains.squarespace.com → your domain → DNS → Custom records → Create new record
2. SPF: Type=TXT, Subdomain=(leave blank), Data=SPF record
3. DMARC: Type=TXT, Subdomain=_dmarc, Data=DMARC record
4. Propagation: ~15 minutes

Email Provider Quick Reference

How to Verify Your Setup

Wait 15–48 hours after adding records, then verify with these tools:

• MXToolbox.com — SPF Lookup, DKIM Lookup, DMARC Lookup — green checkmark = valid
• mail-tester.com — Send a real email, get a 1–10 score with specific fixes (aim for 8+)
• Google Postmaster Tools — postmaster.google.com — shows domain reputation and authentication pass rates with Gmail
• dnschecker.org — Verify global propagation across multiple DNS servers worldwide
• MailPilot — Continuous automated monitoring with alerts when any authentication record breaks

Troubleshooting Common Errors

"Too many DNS lookups" (SPF PermError)

SPF allows max 10 DNS lookups. Each include:counts as one. Fix: use dmarcian's SPF Surveyor to count your lookups, then merge or flatten redundant includes using an SPF flattening service.

"Multiple SPF records found"

Delete one and combine into a single record: merge v=spf1 include:_spf.google.com ~all and v=spf1 include:servers.mcsv.net ~all into v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.

"No DKIM record found"

You're likely using the wrong selector. For Google Workspace: google. For Microsoft 365:selector1 and selector2. Confirm the exact selector in your email provider's admin panel.

"DMARC policy not found"

The record must be at _dmarc.yourdomain.com. In your DNS provider, set the Name/Host to just _dmarc — the provider appends your domain automatically.

Passes SPF/DKIM but still lands in spam

Authentication is necessary but not sufficient. Other signals: new domain with no sending history (requires warmup), spam complaint rate above 0.1%, high bounce rate, or spammy content patterns. See our email warmup guide for the full picture.

BIMI: Show Your Logo in Gmail

BIMI displays your company logo in Gmail next to your sender name. Requirements:

1. DMARC at p=quarantine or p=reject
2. A Verified Mark Certificate (VMC) from Entrust or DigiCert (~$1,500/year for Gmail)
3. SVG logo in BIMI-compliant format (square, solid colors, trademarked)
4. BIMI TXT record at default._bimi.yourdomain.com: v=BIMI1; l=https://yourdomain.com/bimi.svg; a=https://yourdomain.com/bimi.pem

Focus on SPF, DKIM, and DMARC first. Once you reach p=reject and stable reputation, BIMI improves open rates by 8–12% through brand recognition.