How to Set Up SPF, DKIM and DMARC (Step by Step, 2026)

Short answer

Publish one SPF record listing every service that sends mail as your domain, turn on DKIM signing at each of those services, then add a DMARC record starting with p=none and a report address. Read the reports for a few weeks, fix any failing senders, and move DMARC to p=quarantine and then p=reject.

Key points

SPF lists the servers allowed to send; DKIM signs each message; DMARC ties both to the visible From address and tells receivers what to do on failure.
Gmail, Yahoo and Outlook.com require SPF, DKIM and a DMARC record from bulk senders.
Start DMARC at p=none with reporting, then tighten. Never jump straight to p=reject.

Step 1: List everything that sends mail as your domain

Most authentication problems come from forgotten senders. Before touching DNS, write down every system that sends e-mail with your domain in the From address:

Your mailbox provider (Google Workspace, Microsoft 365, your web host).
Newsletter and marketing tools, CRM systems, help desks.
Your website or shop (order confirmations, password resets), invoicing and HR tools.

Each provider documents what to add to SPF and how to enable DKIM. Check your current state first with the SPF checker and DMARC checker.

Step 2: Publish one SPF record

SPF is a single TXT record on your domain. It starts with v=spf1, lists allowed senders and ends with an all rule:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Only one SPF record per domain. Two records cause a permanent error and SPF fails for all mail.
Stay within 10 DNS lookups. Every include, a, mx and redirect counts, including those nested inside includes. The SPF checker counts them for you.
End with ~all (softfail) or -all (fail). Never use +all.
Domains that never send mail should publish v=spf1 -all.

Step 3: Turn on DKIM for every sender

DKIM adds a cryptographic signature to each message. Each service gives you a selector and a public key to publish at selector._domainkey.yourdomain, often as a CNAME to the provider. Then you switch signing on in that service.

Use 2048-bit RSA keys where the provider offers a choice.
Check each key with the DKIM lookup using the selector from the provider.
Send yourself a test message and paste its headers into the e-mail header analyzer: you want dkim=pass with header.d= your domain.

Step 4: Add DMARC in monitoring mode

Publish a TXT record at _dmarc.yourdomain:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain

A message passes DMARC when SPF or DKIM passes and the domain that passed matches the visible From domain (alignment). With p=none, receivers deliver everything but send you daily aggregate reports showing which servers send as your domain and whether they pass.

Step 5: Read the reports, then enforce

Aggregate reports are XML files; a DMARC reporting service or an open-source parser makes them readable. For each source that fails, either fix its SPF/DKIM setup or stop it from using your domain. When legitimate mail passes consistently, move to p=quarantine, then p=reject. Our guide on moving from p=none to p=reject covers this step in detail.

How to verify everything works

SPF checker: one record, under 10 lookups, ends with ~all or -all.
DKIM lookup: a valid key for every selector you use.
DMARC checker: valid syntax and a working report address.
Header analyzer on a real message: dmarc=pass.

Frequently asked questions

In what order should I set up SPF, DKIM and DMARC?

SPF and DKIM first, for every sender, then DMARC with p=none. DMARC depends on the other two.

Do I need both SPF and DKIM?

DMARC needs only one to pass with alignment, but set up both. SPF breaks on forwarding; DKIM survives it.

How long does it take?

The DNS records take minutes. Collecting enough DMARC reports to enforce safely usually takes two to six weeks.

Can SPF, DKIM and DMARC stop all phishing?

They stop direct spoofing of your exact domain. They do not stop look-alike domains or compromised accounts.

How to set up SPF, DKIM and DMARC: a step-by-step guide