How to set up SPF, DKIM and DMARC for your business email

If your invoices and quotes keep ending up in clients' spam folders, missing email authentication is the most likely reason. Since 2024 Gmail and Yahoo have checked for it on every message, and from November 2025 Gmail has been rejecting more mail that fails. The fix is three DNS records, and the order you add them in matters.

What do SPF, DKIM and DMARC actually do?

Each one answers a different question the receiving mail server asks:

SPF and DKIM prove the email is genuine. DMARC tells receivers how strict to be and sends you reports, so you can see who is sending email using your name.

Before you start: list everything that sends email as you

This is the step people skip, and it's why their DMARC setup later blocks their own invoices. Write down every service that sends email from your domain:

• Your mailbox provider (Google Workspace, Microsoft 365, your host's email)
• Your website's contact forms and shop order emails
• Newsletter tools such as Mailchimp or Brevo
• Invoicing and booking software (Xero, QuickBooks, Calendly)
• Your CRM or helpdesk

Each of these needs to be covered by SPF, DKIM or ideally both. Most of them publish the exact include value or DKIM record in their help pages.

Step 1: Add one SPF record

1. Open the DNS settings for your domain. This is wherever your domain's nameservers point: your registrar, your host, or a service like Cloudflare.
2. Check for an existing TXT record starting with v=spf1. If there is one, edit it rather than adding a second. Two SPF records break SPF entirely.
3. Create or edit a TXT record on the root of the domain (the host is usually @) with the value for your provider:
   • Google Workspace: v=spf1 include:_spf.google.com ~all
   • Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
4. Add an include: for each other service on your list that asks for one, before the all at the end. Copy the exact value from that service's help pages; the record then looks like v=spf1 include:_spf.google.com include:<value-from-the-service> ~all. Some services, including most newsletter tools, now ask for DKIM instead of SPF, which is better.
5. Save.

Watch the 10-lookup limit. SPF allows at most 10 DNS lookups. Every include:, a, mx, exists and redirect counts, and so do the includes inside them. Go over and SPF fails for every email with a "permerror". If you use lots of services, use DKIM for some of them instead of adding more includes.

-all or ~all? Microsoft recommends -all (hard fail) once DKIM and DMARC are in place, because DMARC can then act on messages that fail SPF. Google's own examples use ~all. Either works with DMARC; we'd use ~all while you're still finding all your senders, then move to -all.

Step 2: Turn on DKIM

DKIM keys are generated by your email provider, so you copy their record into your DNS rather than writing your own.

Google Workspace

1. In the Google Admin console, go to Apps > Google Workspace > Gmail > Authenticate email.
2. Select your domain and generate a new record (choose a 2048-bit key if your DNS host supports it).
3. Copy the host name (usually google._domainkey) and the TXT value into your DNS.
4. Wait for DNS to update, then click Start authentication.

Microsoft 365

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM.
2. Select your domain. Microsoft shows two CNAME records to add.
3. Add both CNAME records to your DNS exactly as shown.
4. Return to the DKIM page and switch on Sign messages for this domain with DKIM signatures.

Do the same for any other service on your list that offers DKIM (most newsletter and invoicing tools do, usually as a "domain authentication" setting).

Step 3: Wait 48 hours, then add DMARC at p=none

Google recommends allowing 48 hours after SPF and DKIM before adding DMARC, so the first reports reflect your finished setup.

1. Create a mailbox or group to receive reports, such as dmarc@yourdomain.com. Reports arrive daily and can be numerous, so keep them out of your main inbox.
2. Add a TXT record with the host _dmarc (some DNS panels need the full _dmarc.yourdomain.com) and this value:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

1. Save, then check it with a DMARC lookup tool.

p=none means "don't block anything, just report". It's the minimum Gmail requires from bulk senders and the safe starting point for everyone.

Step 4: Read the reports, then tighten the policy

DMARC reports are XML files, which are hard to read on their own. A free report viewer (several DMARC services offer one) turns them into a list of every server sending as your domain and whether it passed.

1. For two to four weeks, look for legitimate services that fail. Fix each one by adding it to SPF or setting up its DKIM.
2. When everything legitimate passes, change the policy to quarantine, which sends failures to spam:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

1. pct=25 applies the policy to a quarter of failing messages. Raise it to 100 over a few weeks.
2. Optionally, move to p=reject once you're confident. This blocks spoofed email outright and is required if you later want your logo shown in inboxes with BIMI.

How do I check it's all working?

Send an email from your domain to a Gmail address, open it, and choose Show original from the three-dot menu. You should see SPF: PASS, DKIM: PASS and DMARC: PASS. If any fail, the details on that page show which domain or record was checked, which usually points straight at the problem.

Common mistakes we see

• Two SPF records after switching email provider. Merge them into one.
• DMARC added before DKIM was switched on, then jumped straight to p=reject. Invoices from the accounting software vanish.
• Forgetting the website. Contact form emails sent by the web server fail SPF. Send them through your mailbox provider using SMTP instead, or add the server to SPF.
• Copying records with smart quotes from a document. DNS needs plain straight quotes, or none at all.