SPF DKIM DMARC Setup: Add the Three Records Yourself

SPF DKIM DMARC is the trio of DNS records that proves your marketing email really comes from your domain. SPF lists the servers allowed to send for you, DKIM signs each message, and DMARC tells inboxes what to do when a message fails both. The method takes an afternoon: list every service that sends as you, publish one SPF record, turn on DKIM in each sending service, add a DMARC record set to none with a report address, then watch the reports and tighten. All of it happens at your domain's DNS host, for free.

What SPF, DKIM and DMARC each prove

Each record answers a different question a receiving server asks. Think of them as three locks on one door.

SPF record: who may send for you

An SPF record is one line of text in a TXT record that lists every server allowed to send email for your domain. It always starts with v=spf1. Google's example for a domain that sends only through Google Workspace is v=spf1 include:_spf.google.com ~all, and each extra sender gets its own include: tag, up to 10 of them ^[1]. If a third-party sender is missing from the record, its mail is more likely to be marked as spam.

DKIM: a signature on every message

DKIM adds a cryptographic signature that lets the receiver check the domain owner really sent the message and that nothing changed on the way. If you send with Google Workspace, you turn DKIM on there; for other senders, Google points to free online tools that create the keys, or to your domain provider. Each sender signs separately. Google requires a key of at least 1024 bits for personal Gmail accounts and recommends 2048 bits where your provider supports it.

DMARC: the instruction for failures

DMARC tells the receiving server what to do with mail that fails SPF and DKIM: deliver it anyway (none), send it to spam (quarantine) or refuse it (reject). To pass, the domain that authenticates must match the domain in the From: header. This is alignment, and it is where most homemade setups slip.

What Gmail and Yahoo require today

Since February 2024, both big mailbox providers enforce sender rules, and the bar depends on how much you send. Google defines bulk senders as those sending more than 5,000 messages per day to Gmail accounts ^[2]. Yahoo uses the same two tiers but does not print a number on its page.

Two details matter for a small sender. Google asks everyone to keep the spam rate in Postmaster Tools below 0.10% and never reach 0.30%. Yahoo asks bulk senders to honor unsubscribes within 2 days and accepts relaxed alignment ^[3]. Neither provider promises inbox placement for meeting the rules. They only say mail that misses them may be rejected or filtered.

The SPF DKIM DMARC setup, step by step

You need a login to your domain host, usually where you bought the domain. Google's own pages say nothing has to happen in the Google Admin console for SPF or DMARC; both are records you paste at the host.

1. List every sender. Write down everything that sends as your domain: your mailbox provider, your email marketing service, your store, your contact form, your help desk. Missing one is the most common SPF failure.
2. Build the SPF line. Start with v=spf1, add one include: per sender (each service's own setup page gives its value), and end with ~all, which Google recommends.
3. Publish SPF. At the DNS host, open the page for TXT records. Add or update a TXT record with host @ and your SPF line as the value. If a record starting with v=spf1 already exists, edit it rather than adding a second one. SPF can take up to 48 hours to start working.
4. Turn on DKIM in each sending service. If you send with Google Workspace, Google's help walks you through turning DKIM on for your domain. For anything else, Google says to confirm that your email service authenticates your domain's mail with SPF and DKIM, or to ask your domain provider for help.
5. Wait 48 hours. Google says SPF and DKIM should be authenticating for at least 48 hours before you turn on DMARC.
6. Create a report mailbox. Set up a group or dedicated address for DMARC reports. Google advises against your own inbox, because report volume can be high.
7. Publish DMARC. Add a TXT record with host _dmarc.example.com (your domain in place of example.com) and a value such as v=DMARC1; p=none; rua=mailto:dmarc@example.com ^[4]. Some hosts add the domain name automatically, so check the host field after saving.

That is how to set up DMARC without breaking anything. With p=none, mail is delivered as before and the reports start arriving.

When to tighten the policy

Google's rollout advice is gradual. Keep p=none for about a week and read the reports daily. If every legitimate stream passes, move to quarantine for a small share of mail with the pct tag, for example 5 or 10 percent, and raise it over time. reject comes last, if at all. Under reject, failing mail is never delivered.

A worked example: one shop, three records

This is an illustration with invented details. A two-person shop at example.com sends staff mail through Google Workspace and a monthly newsletter through an email platform.

• SPF: one TXT record at @ containing v=spf1 include:_spf.google.com include: plus the platform's value, then ~all. One record, two senders.
• DKIM: two signatures, one for Workspace mail and one for the newsletter platform, each switched on through that service's own setup and published at the host.
• DMARC: one TXT record at _dmarc.example.com reading v=DMARC1; p=none; rua=mailto:dmarc@example.com.

A week later, the reports show both streams passing. They also show a third source nobody listed: the website's contact form, sending as the shop's domain. It goes into the SPF record before the policy moves to quarantine. Skipping the monitoring week would have put those form emails at risk of the spam folder as soon as quarantine applied.

Free checks after you publish

You do not need paid tools to confirm the records work. Three free checks cover it. Run them in this order.

• A free DNS lookup. Google's pages point to the many free tools online that read your SPF and DMARC records back. Check the exact text, the host and that there is only one SPF line.
• DMARC aggregate reports. The rua address receives daily reports that show which servers sent as your domain and whether they passed. They are the only way to catch a forgotten sender.
• Google Postmaster Tools. Add the domain you authenticate with (the DKIM d= domain or the SPF Return-Path domain), verify it with a TXT or CNAME record at the host, and the dashboards show spam rate, reputation, authentication and delivery errors. Verification usually takes minutes.

Postmaster Tools has two limits worth knowing. Its data covers only personal Gmail accounts, the ones ending in gmail.com or googlemail.com. And it shows nothing on days when your volume is too low, to protect user privacy.

Where doing it yourself stops: the list, not the records

Perfect records get you past the authentication gate. That is all. They do not keep you in the inbox. The threshold comes when the records pass but complaints, bounces or volume still hurt. Google's guidance turns to list behavior at that point: automatically unsubscribe people with multiple bounced messages, consider unsubscribing people who never open, and periodically confirm that subscribers still want your mail. Yahoo adds double opt-in and prompt removal of invalid addresses.

Concretely, the homemade route breaks in three places. First, one-click unsubscribe is a pair of headers inside every message, not a DNS record. You cannot add it at your domain host. Second, email list cleaning by hand means matching bounce notices to rows in a spreadsheet after every send, which stops being realistic once a list reaches the low thousands. Third, a spam rate creeping toward 0.3% needs a fast response, and you only see it in Postmaster Tools if your Gmail volume is high enough to show data at all.

That is where an email platform's hygiene features earn their place. Kit recommends authenticating a verified sending domain and adding a DMARC record, and documents both steps. MailerLite has a Clean up inactive tab and double opt-in on forms. Mailchimp marks hard-bounced addresses as Cleaned and stops mailing them, which our guide to what Cleaned means unpacks. Brevo publishes its own suspension thresholds per campaign: over 2% hard bounces, 1% unsubscribes or 0.2% complaints.

What these platforms add is help with the list, the opt-in and the warnings; the records themselves are published at your DNS host, as above. For the full comparison of platforms and outside services built around this job, see our email deliverability tools guide. If you are still diagnosing why mail lands in spam at all, start with the email deliverability overview.

The bottom line

Setting up SPF, DKIM and DMARC yourself is free, takes an afternoon and is now the price of entry at Gmail and Yahoo. List every sender, publish one SPF line, turn on DKIM in each service, wait 48 hours, then add DMARC at none with a report mailbox and tighten only after the reports come back clean. Once the records pass, the work moves to the list: bounces, complaints, unsubscribes and inactive readers. That part is where a platform's hygiene tools stop being optional.