SPF, DKIM and DMARC Setup Guide

List quality gets you past the bounce filter. These three DNS records get you past the spam filter. All three are free, all three are plain DNS text, and all three are checkable in seconds with the SPF & DMARC Checker.

1. SPF: who may send for you

A TXT record at your domain starting with v=spf1 lists the servers allowed to send your mail, e.g. v=spf1 include:_spf.google.com ~all. Receivers check the connecting server against it. No SPF record means anyone can claim to be you with zero friction.

2. DKIM: proof the mail wasn’t altered

Your mail server cryptographically signs outgoing mail; receivers verify the signature against a public key published at SELECTOR._domainkey.yourdomain — where SELECTOR comes from your mail provider (often default, google, or similar). Because selectors can’t be discovered automatically, no honest tool checks DKIM for you: copy the selector from your provider’s setup docs and query that exact name with any DNS lookup tool.

3. DMARC: instructions for failures

A TXT record at _dmarc.yourdomain starting with v=DMARC1 tells receivers what to do when SPF or DKIM fail — p=none (report only), p=quarantine, or p=reject — plus where to send aggregate reports (rua=).

4. The safe rollout order

1. Publish SPF first; watch for legitimate senders you forgot (newsletters, CRM, support desk) over two weeks.
2. Add DKIM signing in your provider, then publish the key.
3. Publish DMARC at p=none with a rua= mailbox and read the reports.
4. Move to quarantine, then reject, only when reports show aligned, legitimate traffic.

Skipping straight to p=reject is how teams silently discard their own invoices.

5. Verify, don’t assume

After every DNS change, re-run the SPF & DMARC Checker — DNS propagates in minutes to hours, and a typo’d record is worse than none because it looks intentional. Pair domain authentication with list hygiene from the validation guide: inbox placement needs both a clean list and a trustworthy domain.