Set Up SPF, DKIM, and DMARC to Improve Email Deliverability

Introduction

If your business emails are landing in spam, the most common cause is missing or misconfigured email authentication. SPF, DKIM, and DMARC help receiving mail servers verify that your messages are legitimate and that they come from approved senders. This guide explains how to set up these records so your business email is more likely to reach the inbox.

Why SPF, DKIM, and DMARC matter

These three DNS records work together to improve trust, reduce spoofing, and strengthen deliverability. SPF tells mail servers which systems are allowed to send email for your domain. DKIM adds a cryptographic signature to prove the message was not altered in transit. DMARC tells receiving servers what to do when SPF or DKIM checks fail and gives you visibility through reports.

Prerequisites

• Access to your domain’s DNS management panel
• A list of all services that send email on behalf of your domain
• DKIM values or signing instructions from each email provider
• A DMARC reporting email address or reporting service
• Time to test changes after each update

Step-by-step instructions

Step 1: List every service that sends email for your domain

Start by identifying every platform that sends mail using your domain, such as Google Workspace, Microsoft 365, your CRM, your website forms, your billing system, or an email marketing tool. SPF and DKIM must match the services you actually use. If a sender is not approved, remove it or do not include it in your records.

Step 2: Add or update your SPF record

Publish a single SPF TXT record in your DNS for the domain. Include all approved sending services and only those services. Avoid creating multiple SPF records for the same domain, because that can cause validation failures. If you use several tools, combine their approved mechanisms into one record and keep it within DNS lookup limits.

Example format: v=spf1 include:[service1] include:[service2] -all

Step 3: Enable DKIM for each sending service

Turn on DKIM signing in each email platform you use. Most providers will give you one or more DNS records, usually CNAME or TXT records, to publish in your domain DNS. If you send from multiple tools, use separate DKIM selectors or keys where needed so each service can sign messages correctly.

Step 4: Publish a DMARC record

Add a DMARC TXT record to the _dmarc subdomain. Begin with a monitoring policy so you can observe authentication results before enforcing stricter rules. Make sure your record includes a reporting address so you can receive aggregate reports.

Example format: v=DMARC1; p=none; rua=mailto:[reports@example.com]

Step 5: Test each record after publishing

After each DNS change, verify that the record is visible and valid. Send test emails from each approved service and confirm that SPF, DKIM, and DMARC pass in the message headers. Fix any alignment issues before moving to the next step.

Step 6: Review DMARC reports and tighten policy gradually

Monitor DMARC aggregate reports to see which systems are sending mail for your domain and whether any messages are failing authentication. Once you are confident that all legitimate senders are covered, move from monitoring to enforcement by changing the policy from none to quarantine, and later to reject if appropriate.

Best practices

• Keep SPF limited to approved senders only
• Use DKIM for every platform that sends email as your domain
• Start DMARC with p=none before enforcing stricter policies
• Check DNS propagation and validation after every change
• Remove unused senders from SPF and DKIM setups
• Keep a record of all email services and DNS changes

Common issues to watch for

• Multiple SPF records published for the same domain
• Missing DKIM records for one of your sending tools
• DMARC set to reject before legitimate senders are fully configured
• Email sent from a domain that does not match the authenticated sender
• Exceeding SPF DNS lookup limits

Next steps

Once SPF, DKIM, and DMARC are working correctly, continue monitoring deliverability, sender reputation, and inbox placement. If you use multiple tools for marketing, CRM, support, or transactional email, review your setup whenever you add or remove a service. For complex environments, consider a full DNS and email deliverability audit.

Additional information

If you need help configuring SPF, DKIM, DMARC, or DNS for Google Workspace, Microsoft 365, Lark Suite, bulk email infrastructure, or multi-sender environments, RKS Best can assist with implementation and validation. You can also maintain separate DKIM keys for different services and use DMARC reports to identify unauthorized or failing senders.

Disclaimer

Email authentication settings vary by provider, DNS host, and sending architecture. Use this guide as a general implementation reference and verify all changes in your own environment before enforcing stricter policies. If you are unsure about DNS edits or mail routing, seek professional assistance.