How to Set Up SPF, DKIM and DMARC Records
We explain how to create SPF, DKIM and DMARC records and test that they work correctly, so your emails do not land in spam and your domain cannot be spoofed.
Aurora YazılımEditorial team
6 min read
SPF DKIM DMARC records are added to your domain’s DNS panel as TXT records (CNAME with some providers). SPF defines which servers may send email on your behalf, DKIM provides a digital signature showing the message was not altered, and DMARC defines what to do with messages that fail these checks. Set up SPF and DKIM first, then DMARC with p=none.
Why Do Emails Land in Spam?
Receiving servers such as Gmail, Outlook and Yahoo check whether every incoming message really comes from the sender’s domain. Messages without authentication either go to the spam folder or are not delivered at all. The most common cause of the emails going to spam complaint is that these three records are missing or wrong.
These records are also a security measure. If they are not set up correctly, scammers can use your domain to send your customers fake invoices or payment requests. We cover the account security side against phishing in our articles on creating strong passwords and what is a passkey.
Google and Yahoo expect all three of SPF, DKIM and DMARC from bulk senders who send more than 5,000 messages a day, and at least SPF or DKIM from all senders. Even if you send fewer emails, setting up all three noticeably improves deliverability.
Preparation Before Setup
Before writing the records, list all the services that send email on behalf of your domain. This list should include not only your business email provider but also your website’s form notifications, your newsletter tool and software that sends invoices and order notifications.
- Access to the domain’s DNS panel (your domain registrar or a DNS service such as Cloudflare)
- Your business email provider: Google Workspace, Microsoft 365 or your hosting company’s email
- The servers from which your site, newsletter and notification tools send
- An email address to receive DMARC reports (e.g. dmarc@example.com)
How Do You Write an SPF Record?
An SPF record is a TXT record added to your domain’s root (@) address and starting with v=spf1. It contains the addresses of the servers you allow to send on your behalf and, at the end, a qualifier that says what to do with all others.
A domain can have only one SPF record. When you add a new service, add an include statement to the existing record instead of creating a second one; two separate SPF records cause the check to fail entirely.
- ~all (softfail): servers not on the list are treated as suspicious; a safe choice during the transition period.
- -all (fail): servers not on the list are rejected; use it once you are sure of all sending sources.
- SPF evaluation allows at most 10 DNS lookups; every include counts toward this limit. If the limit is exceeded, the record becomes invalid.
Type: TXT Name: @
v=spf1 include:_spf.google.com ~allType: TXT Name: @
v=spf1 include:spf.protection.outlook.com -allv=spf1 ip4:203.0.113.10 include:_spf.google.com include:<bulten-araci-spf-adresi> ~allWhat Is DKIM and How Do You Set It Up?
DKIM is a digital signature added to every message sent. The sending server signs the message with a private key, and the receiving server verifies the signature with the public key you publish in DNS. That proves the message was not changed in transit and really came from your domain.
You do not generate the DKIM key yourself; it is created in your email provider’s panel. The panel gives you a selector name and the value you need to add to DNS. If possible, choose a 2048-bit key. After adding the record, do not forget to start or enable signing in the provider’s panel; otherwise messages are not signed even if the record is live.
| Provider | Record type and name |
|---|---|
| Google Workspace | TXT, google._domainkey (default selector google) |
| Microsoft 365 | Two CNAMEs shown in the panel: selector1._domainkey and selector2._domainkey |
| Hosting email | TXT record with the selector shown in the panel |
| Newsletter tools | CNAME or TXT records provided by the tool |
Type: TXT Name: google._domainkey
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...The DMARC Record and Choosing a Policy
A DMARC record is a TXT record added to the _dmarc subdomain. It requires that at least one of the SPF and DKIM checks pass and that the passing check be aligned with the domain in the From line. If this requirement is not met, the policy decides what the receiving server does.
Turning DMARC on directly with the strictest policy can cause emails from a sending source you forgot (e.g. a site form) to be lost. That is why a gradual rollout is recommended: first only monitor, then tighten the policy once the reports show that all legitimate sources pass.
The DMARC policy on the main domain also applies to subdomains that have no record of their own. If you want a different policy for subdomains, you can use the sp tag or add a separate _dmarc record to that subdomain. Monitoring reports for at least a few weeks at each stage of the rollout ensures you do not overlook any legitimate sending source. For other guides on DNS records, see the DNS tag.
- p=none: messages are not affected, reports are only collected.
- p=quarantine: messages that fail the checks are sent to the spam folder.
- p=reject: messages that fail the checks are rejected; the strongest protection against domain spoofing.
- The aggregate reports that arrive at the rua address are in XML format; using a DMARC report tool makes reading them easier.
Type: TXT Name: _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@ornek.comv=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@ornek.comv=DMARC1; p=reject; rua=mailto:dmarc@ornek.comHow Do I Test the Records?
It can take anywhere from a few minutes to a few hours for DNS changes to propagate. Check from the command line that the records are live; the output should show the value you entered exactly.
dig TXT ornek.com +short
dig TXT google._domainkey.ornek.com +short
dig TXT _dmarc.ornek.com +shortnslookup -type=TXT ornek.com
nslookup -type=TXT _dmarc.ornek.com
Resolve-DnsName google._domainkey.ornek.com -Type TXTTesting with a real message
Send an email from your business address to a personal Gmail account. Open the message and click Show original in the menu at the top right. On the page that opens, all three lines for SPF, DKIM and DMARC should say PASS; if you see FAIL or NEUTRAL, recheck the relevant record.
Common Errors and Fixes
Messages sent from your website are the most often overlooked source of these problems. If the site’s contact form or order notification is sent directly from the server without authentication, it fails the SPF and DKIM checks. Sending forms through your business email account with authenticated SMTP solves this at the root. When setting up a corporate website or an e-commerce platform, make sure notification emails are configured this way.
| Symptom | Likely cause and fix |
|---|---|
| SPF PermError | There are two SPF records or the 10-lookup limit was exceeded; merge the records and remove unnecessary includes. |
| DKIM FAIL | The record was copied incompletely or signing was not started in the panel. |
| DMARC FAIL, SPF PASS | SPF passes for another domain; add a DKIM signature aligned with the From domain. |
| Emails from the site form land in spam | The form sends with the unauthenticated mail() function; use authenticated SMTP. |
| The record is in the panel but not in the query | The domain was written twice in the name field (e.g. _dmarc.example.com.example.com). |
Frequently Asked Questions
01Do I need records for a domain that does not send email?
Yes, especially against spoofing. Adding an SPF record of the form v=spf1 -all and a DMARC record with p=reject to a domain that never sends email makes it harder for scammers to use that domain.
02I added the records but my emails still land in spam. Why?
Authentication is only one part of deliverability. Factors such as the reputation of the IP you send from, the quality of the content, the rate at which recipients mark messages as spam and the unsubscribe link also play a role. For bulk sending, use a permission-based list and clean it regularly.
03I see IPs I don’t recognize in DMARC reports. What should I do?
First check whether these IPs belong to a legitimate service you forgot. If they do, add them to your SPF and DKIM settings; if not, they are most likely sends spoofing your domain, and that is a good reason to move the policy to quarantine or reject.
When SPF, DKIM and DMARC are set up together, your emails reach recipients and your domain is protected against spoofing. You can explore Aurora solutions, which handle domain, email and server configuration together with your business software, and contact us to have your records checked. For better deliverability in bulk email campaigns, you can also work with our digital marketing team.
