How to Set Up DKIM, SPF & DMARC: Complete Email Authentication Guide
Published June 12, 2026 · Updated August 25, 2026 · Email Security
Three little DNS records decide whether your email reaches the inbox or the spam folder: SPF, DKIM, and DMARC. Together they prove your mail is genuinely from you. Miss any one and mailbox providers get suspicious. This complete guide sets all three up, in order, in plain English.
What each record does
- SPF lists which servers are allowed to send email for your domain.
- DKIM adds a cryptographic signature so receivers can verify the message was not altered.
- DMARC ties the two together and tells receivers what to do when a message fails.
Step 1: Set up SPF
Add a single TXT record listing your senders, for example v=spf1 include:yoursmtp.com ~all. Include every service that sends for you — and only one SPF record per domain, or it breaks.
Step 2: Set up DKIM
Your SMTP provider generates a public/private key pair. You publish the public key as a TXT record at a selector like default._domainkey.yourdomain.com; the provider signs each outgoing message with the private key. Receivers check the signature and know the mail is authentic.
Step 3: Set up DMARC
Add a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:[email protected] to monitor, review the reports, then tighten to p=quarantine and finally p=reject for full protection.
Troubleshooting a DKIM signature failure specifically
The most common cause is a mismatch between the selector in the DNS record and the selector the sending server actually signs with — double-check both match exactly. The second most common cause is a message being modified in transit (some mailing-list software rewrites headers), which invalidates the signature even though the original send was correctly signed.
How the SPF "include" mechanism works with multiple services
Each third-party sender (your CRM, your marketing tool, your transactional SMTP) gets its own include: entry inside the single SPF record — for example v=spf1 include:yoursmtp.com include:crm-provider.com ~all. Every include adds a DNS lookup, which is why the record must stay under SPF's 10-lookup ceiling even as you add more senders over time.
Get SPF, DKIM & DMARC set up for you
A dedicated SMTP server generates and configures all three records automatically — correct the first time, so your mail lands in the inbox. From $39.99/mo.
Frequently asked questions
In what order should I set up SPF, DKIM, and DMARC?
SPF first, then DKIM, then DMARC. DMARC enforcement depends on SPF and DKIM already passing, so configure and verify them before turning DMARC on.
Can I have more than one SPF record?
No — a domain must have exactly one SPF record. List all your senders inside it; multiple SPF records cause authentication to fail.
How long until the records work?
DNS changes usually propagate within minutes to a few hours. Use an authentication checker to confirm each record passes before enforcing DMARC.