Setting Up SPF, DKIM and DMARC: Deliver Mail, Stop Spoofing

Why your emails land in spam

"Your invoice ended up in our spam folder." If you hear that often, your domain probably lacks the right records. Since 2024, large mailbox providers such as Google and Yahoo require proper authentication from senders, especially at volume. Microsoft followed for Outlook.com.

The same records also stop fraudsters from sending email in your name.

The three building blocks in plain words

• SPF: a list in your domain of which servers may send email for you.
• DKIM: a digital signature on every email. The recipient checks it with a public key from your domain.
• DMARC: the rule for what happens to mail that fails SPF or DKIM, plus reports about it.

Step 1: list all senders

Before adding anything, write down everything that sends email with your domain:

• Your mailbox provider (e.g. Microsoft 365, Google Workspace, IONOS)
• Newsletter tool
• Accounting or invoicing software
• Website contact form
• Shop, ticket system, multifunction printer

This step is skipped most often and later leads to lost emails.

Step 2: add SPF

A single TXT record per domain, for example:

v=spf1 include:spf.protection.outlook.com include:_spf.newsletterprovider.com -all

Important:

• Only one SPF record; several make it invalid
• At most ten DNS lookups across all include entries
• Start with ~all, move to -all later

Step 3: enable DKIM

DKIM is switched on at each service. The service gives you one or two records (usually CNAME) to add to your domain. Repeat for every sender from step 1 that offers DKIM.

Step 4: tighten DMARC step by step

Start in monitoring mode:

_dmarc.your-domain.com TXT v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com

1. A few weeks at p=none: collect reports, add missing senders.
2. p=quarantine: failing mail goes to spam.
3. p=reject: failing mail is rejected. That's the goal.

Reports are technical XML files. Free or low-cost analysis services turn them into readable overviews. Mind the provider's data protection, as the reports contain IP addresses.

Protect unused domains too

Do you have other domains that send no mail? Set SPF to v=spf1 -all and DMARC to p=reject for them. Otherwise fraudsters use exactly those.

Common mistakes

• Two SPF records after switching providers
• DMARC straight to reject without looking at reports
• Contact form sending with your address via a third-party server
• The old provider still listed in SPF after a move

FAQ

Can I set this up myself? If you have access to DNS management, you can with some care. Step 1 is key so no mail gets lost.

How do I check it works? Send a test email to a Gmail account and choose "Show original". SPF, DKIM and DMARC should show "PASS".

Conclusion

SPF, DKIM and DMARC are a one-off effort with a double benefit: better delivery and protection from spoofed senders. They are also part of our Microsoft 365 baseline settings. If you'd like help setting them up, get in touch.