SPF, DKIM and DMARC explained for business email.
SPF, DKIM and DMARC are DNS records that prove email from your domain is genuinely yours. Set up SPF and DKIM first, then DMARC, which tells receiving servers what to do with messages that fail. Gmail requires all three from bulk senders.
By Neural Media Labs4 min read
How we write and check articles is set out in our editorial policy.
What each record does
| Record | What it does |
|---|---|
| SPF | Lists the servers allowed to send email for your domain. |
| DKIM | Adds a digital signature to your messages so receivers can check they were not altered and came from you. |
| DMARC | Tells receiving servers what to do with messages that fail SPF and DKIM checks, and where to send reports. |
Why it matters
Without them, your email is more likely to land in spam, and it is easier for someone else to send messages that look like they come from you. Google's email sender guidelines say that senders who send more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC, and that all other senders need SPF or DKIM. Even a small business benefits from having all three.
The order to set them up
- Set up SPF for every service that sends mail for you, such as your email provider and any newsletter or invoicing tool.
- Turn on DKIM in your email provider and publish the key it gives you in DNS.
- Wait, then add DMARC. Google's DMARC setup guide says DMARC works on top of SPF and DKIM, which must be enabled first, and recommends waiting about 48 hours before turning it on.
- Start with a monitoring policy, read the reports, fix any legitimate senders that fail, and tighten the policy only when you are confident.
Common mistakes
- Forgetting a sending service, so its legitimate mail fails the checks.
- Publishing more than one SPF record for the same domain.
- Jumping straight to a strict DMARC policy and blocking real mail.
- Leaving nobody in charge of the domain's DNS settings.
Our business email setup service configures all three and hands over clear notes. If email is one of several systems you want reviewed, see IT consultancy.
Want this checked on your business?
Book a free AI visibility check. In 30 minutes we show you how your business appears today and what to fix first.