What each record does
SPF is a TXT record on the domain listing the servers allowed to send its mail. DKIM signs each message with a key whose public part is published in DNS. DMARC, at _dmarc.yourdomain, says what to do with mail that passes neither SPF nor DKIM aligned with the visible sender, and where to send reports.
| Example SPF record | DNS lookups in this record | all mechanism |
|---|---|---|
| v=spf1 include:_spf.google.com ~all | 1 | ~all |
| v=spf1 include:spf.protection.outlook.com include:sendgrid.net mx -all | 3 | -all |
| v=spf1 ip4:192.0.2.10 -all | 0 | -all |
Calculated examples; rounded values.
How to read the examples
Each include, a, mx, ptr, exists and redirect counts as one lookup, and so do the ones inside each include. Microsoft 365 or SendGrid add several of their own, so a record with three or four services can approach the limit of 10. ip4 and ip6 ranges use no lookups. The SPF and DMARC checker follows every include and gives you the real total.
Why it matters now
Since 2024 Gmail and Yahoo require SPF or DKIM from every sender, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to their users. Outlook.com has applied similar rules since 2025. Without these records your legitimate mail ends up in spam or rejected, and anyone can spoof your domain more easily.
You do not need to be a large company to notice: invoices, notifications from an online shop or the mail of a small office can stop arriving if the domain is not set up properly.
Step 1: list everything that sends mail
Before touching DNS, write down everything that sends mail as your domain: the mail provider (Google Workspace, Microsoft 365, IONOS…), the newsletter tool, the online shop, the CRM, the phone system, the printer that emails scans or the web server that sends forms.
Each service explains in its help pages which SPF include to use and how to enable DKIM. If you forget one, its messages will fail SPF; that is why DMARC should start in monitoring mode.
Step 2: a single SPF record
Publish one TXT record starting with v=spf1 at the root of the domain. If a service asks you to add its own, do not create a second record: merge its include into the existing one. Two SPF records cause an error (permerror) and receivers ignore both.
End with ~all while you check no service is missing and switch to -all once you are sure. Avoid +all, which authorises the whole Internet, and the ptr mechanism, discouraged because it is slow. If you go over 10 lookups, replace includes with ip4 or ip6 ranges when the provider publishes them, or remove services you no longer use.
Step 3: DKIM in every service
DKIM is enabled from the control panel of each service, which gives you one or two records (TXT or CNAME) to publish at selector._domainkey.yourdomain. Enable it everywhere you can: DMARC passes with aligned SPF or aligned DKIM, and DKIM keeps working when a message is forwarded, where SPF usually fails.
Step 4: DMARC in monitoring mode
Publish a TXT at _dmarc.yourdomain such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. With p=none delivery does not change, but large providers will send you daily aggregate XML reports listing the IP addresses sending as your domain and whether they pass SPF and DKIM.
Those reports are hard to read by hand. Several services turn them into charts, many with a free plan for small domains. Check for two to four weeks that all your legitimate mail shows as passing.
Step 5: move to quarantine and reject
Once the reports are clean, change to p=quarantine: failing mail goes to spam. To be careful, use pct=25 and raise it gradually to 100. After a few more weeks without issues, move to p=reject, so spoofed mail is not delivered at all.
For domains that never send email, such as parked domains or website-only domains, publish v=spf1 -all and v=DMARC1; p=reject straight away. That way nobody can use them to impersonate you.
Frequently asked questions
How long does an SPF or DMARC change take to apply?
As long as the TTL of the previous record takes to expire, usually from a few minutes to a few hours. You can check the published value with the DNS lookup, type TXT.
What does alignment mean in DMARC?
The visible sender domain must match the domain validated by SPF (the envelope sender) or the d= domain of the DKIM signature. A valid SPF for a different domain does not count for DMARC.
Do I need DMARC if I send little email?
It is recommended. With p=none and rua it does not affect delivery and shows you whether someone is spoofing your domain. More and more receivers also take it into account.