Why these records matter

Anyone can send an email that claims to come from your address. SPF, DKIM and DMARC are how the receiving email service checks whether a message really came from you. Without them, two things go wrong: your genuine emails are more likely to land in spam, and criminals find it easier to send fake invoices or payment requests that look like they came from your business.

Large email providers including Google, Yahoo and Microsoft now require these records from businesses that send a lot of email, and they treat mail without them with more suspicion. Even if you only send a few emails a day, setting them up is worth it.

All three are records you add in your domain's DNS, wherever your domain is managed. That is often the company you registered the domain with.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a single TXT record that lists the services allowed to send email for your domain. For a business that sends only through Microsoft 365, it looks like this:

Type: TXT
Host: @
Value: v=spf1 include:spf.protection.outlook.com -all

For Google Workspace, the include is different:

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~all

Things to watch:

  • Only one SPF record per domain. If you use other services that send as you, such as a newsletter tool, a booking system or accounting software that emails invoices, add their include to the same record. Two separate SPF records make both fail.
  • Keep it short. SPF allows a maximum of 10 DNS lookups. Each include counts, and some count more than once.
  • -all means "reject anything not listed" and ~all means "treat it as suspicious". Start with ~all if you are not sure you have listed every sender, then tighten it later.

DKIM: a signature on every email

DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. The receiving server checks the signature against a public key published in your DNS. If the email was changed on the way, or did not come from your provider, the check fails.

In Microsoft 365:

  1. Sign in to the Microsoft Defender portal at security.microsoft.com.
  2. Go to Email & collaboration, Policies & rules, Threat policies, then Email authentication settings, and open the DKIM tab.
  3. Select your domain. Microsoft shows two CNAME records, for selector1 and selector2. Copy them exactly into your DNS.
  4. Wait for DNS to update, which can take up to a day, then come back and switch DKIM signing on for the domain.

In Google Workspace:

  1. In the Google Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email.
  2. Choose your domain and click Generate new record. A 2048-bit key is the usual choice.
  3. Add the TXT record it shows, normally with the host google._domainkey.
  4. Wait for DNS to update, then click Start authentication.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM together. It tells receiving servers what to do with an email that claims to be from you but fails the checks, and it can send you reports about who is sending as your domain. It is a TXT record on the host _dmarc:

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.uk

The p= part is the policy:

  • p=none: monitor only. Nothing is blocked, but you start receiving reports.
  • p=quarantine: emails that fail go to the recipient's spam folder.
  • p=reject: emails that fail are refused outright.

Start with p=none. Read the reports for a few weeks to make sure every genuine service that sends as you passes SPF or DKIM. Then move to quarantine, and finally reject. Jumping straight to reject is how businesses accidentally block their own invoices or website contact forms.

DMARC reports are machine-readable files and arrive daily from several providers. Send them to a dedicated mailbox or a free DMARC report reader rather than someone's main inbox.

How to check your records

Send an email from your business account to a personal Gmail address. In Gmail, open the message, click the three dots and choose Show original. You will see SPF, DKIM and DMARC each marked PASS or FAIL. If any say FAIL, the record is missing, mistyped or has not updated yet.

Free online lookup tools will also show what your domain currently publishes. Check after every change.

Common mistakes

  • Two SPF records on the same domain.
  • Forgetting a service that sends as you, so its emails start going to spam after DMARC is tightened.
  • Adding the DKIM records but never switching signing on.
  • Typing the full domain into the host field when the DNS provider adds it automatically, giving _dmarc.yourbusiness.co.uk.yourbusiness.co.uk.
  • Setting DMARC to reject on day one.

Want it done for you?

RoamTech sets up and checks SPF, DKIM and DMARC as part of Microsoft 365 setup and Google Workspace setup, and as a stand-alone job for businesses anywhere in the UK. It is done remotely, with your permission to access the DNS. If you are also moving email provider, read moving your email to Microsoft 365 first, because the records change during the move.