How to Set Up DKIM, SPF & DMARC: Complete Email Authentication Guide
Published June 12, 2026 · Updated July 19, 2026 · Email Security
Three little DNS records decide whether your email reaches the inbox or the spam folder: SPF, DKIM, and DMARC. Together they prove your mail is genuinely from you. Miss any one and mailbox providers get suspicious. This complete guide sets all three up, in order, in plain English.
What each record does
- SPF lists which servers are allowed to send email for your domain.
- DKIM adds a cryptographic signature so receivers can verify the message was not altered.
- DMARC ties the two together and tells receivers what to do when a message fails.
Step 1: Set up SPF
Add a single TXT record listing your senders, for example v=spf1 include:yoursmtp.com ~all. Include every service that sends for you — and only one SPF record per domain, or it breaks.
Step 2: Set up DKIM
Your SMTP provider generates a public/private key pair. You publish the public key as a TXT record at a selector like default._domainkey.yourdomain.com; the provider signs each outgoing message with the private key. Receivers check the signature and know the mail is authentic.
Step 3: Set up DMARC
Add a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:[email protected] to monitor, review the reports, then tighten to p=quarantine and finally p=reject for full protection.
Get SPF, DKIM & DMARC set up for you
A dedicated SMTP server generates and configures all three records automatically — correct the first time, so your mail lands in the inbox. From $39.99/mo.
Frequently asked questions
In what order should I set up SPF, DKIM, and DMARC?
SPF first, then DKIM, then DMARC. DMARC enforcement depends on SPF and DKIM already passing, so configure and verify them before turning DMARC on.
Can I have more than one SPF record?
No — a domain must have exactly one SPF record. List all your senders inside it; multiple SPF records cause authentication to fail.
How long until the records work?
DNS changes usually propagate within minutes to a few hours. Use an authentication checker to confirm each record passes before enforcing DMARC.