Email · fix guide

How to set up SPF, DKIM and DMARC for your domain

Three free DNS records stop people forging email from your domain and keep your own mail out of spam. Here are the exact records for Google Workspace and Microsoft 365, and how to move DMARC from monitoring to full protection.

Published October 22, 2026Updated October 22, 2026By Remidiy

Short answer: publish one SPF record on your domain listing every service that sends your email (for Google Workspace: v=spf1 include:_spf.google.com ~all), turn on DKIM signing in your email provider's admin panel, then add a DMARC record at _dmarc.yourdomain.com starting with v=DMARC1; p=none; rua=mailto:[email protected].

After a week or more of clean reports, move DMARC to p=quarantine, then p=reject. All three are free DNS TXT records you add wherever your domain's DNS is managed.

Email has no built-in proof of who sent a message, so anyone can put your domain in the From line. Three DNS records fix that. SPF (Sender Policy Framework) lists the servers allowed to send for your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. DMARC tells receiving servers what to do when a message claiming to be from you passes neither check, and sends you reports. The checker reads MX, SPF and DMARC from public DNS for your main domain (www.example.com is checked as example.com). It can't test DKIM, whose keys sit under a selector name only your provider knows.

No mail server (MX) records

Minor Shown in the checker's Email & domain tab as “No mail server (MX) records for yourdomain.com”.

The checker flags this when a DNS lookup for MX records on your domain returns none. MX records tell the world which server accepts mail for [email protected].

Why it matters

With no MX record, mail sent to your domain usually can't be delivered: sending servers fall back to the server your website runs on, which normally doesn't accept mail. That's fine if you deliberately use a Gmail or Outlook.com address, but customers trust a matching address more, and it's worth confirming nobody is writing to an address that no longer works.

How to fix it

Google Workspace

Add one MX record with priority 1 and the value smtp.google.com, then activate Gmail in the Admin console. Domains set up before 2023 may use the older aspmx values, which still work (Google: set up MX records).

Microsoft 365

Add your domain in the Microsoft 365 admin center. It shows the exact MX value for your domain, which you copy into your DNS host.

Not using email at this domain?

Leave MX out, but still publish v=spf1 -all (no server may send for this domain) and a DMARC record with p=reject. That stops spammers from using an unused domain to impersonate you.

No SPF record

Fix soon Shown in the checker's Email & domain tab as “No SPF record for yourdomain.com”.

The checker looks for a TXT record on your domain that starts with v=spf1 and flags the domain when there isn't one.

Why it matters

Without SPF, receiving servers have no list of who may send for you, so forged mail is harder to spot and your real mail is more likely to land in spam. Gmail has required every sender to use SPF or DKIM since February 1, 2024, and Yahoo has the same rule (Google: email sender guidelines, Yahoo: sender requirements).

How to fix it

List every service that sends mail as your domain (mailbox provider, website form, booking, newsletter and invoicing tools), then add one TXT record at the root of the domain, often shown as host @:

Google Workspace only:
v=spf1 include:_spf.google.com ~all

Microsoft 365 only:
v=spf1 include:spf.protection.outlook.com -all

Both:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

These values come from Google's SPF setup guide and Microsoft's SPF guide. Other senders publish their own include: value in their help pages.

Two rules catch most people out. Have only one SPF record per domain, because two cause a permanent error (permerror) and SPF can't pass for any of your mail. To add a sender, edit the existing record. And keep it under 10 DNS lookups: each include: counts at least one, and the standard makes going over the limit a failure (RFC 7208).

Where to add it

Add the record wherever your DNS is managed: your registrar (GoDaddy, Namecheap, Squarespace Domains and so on), Cloudflare if your nameservers point there, or cPanel's Zone Editor on shared hosting. If your website platform runs your DNS, look for “DNS records” in its domain settings.

SPF record lets any server send

Minor Shown in the checker's Email & domain tab as “SPF record doesn't end in ~all or -all”.

The checker flags an SPF record that has no ~all or -all term. That covers records ending in +all (anyone may send), ?all (neutral, no opinion) or with no all at all.

Why it matters

The all term at the end says what happens to servers not on your list. +all authorises the whole internet, so the record protects nothing. ?all and a missing all give receivers no guidance. ~all (softfail) marks unlisted senders as suspicious, and -all (fail) says they're not allowed.

How to fix it

Edit the record so it ends in ~all, which is what Google recommends, or -all, which Microsoft uses in its examples. Once DMARC is enforcing, either works well. One exception: a record that hands control to another domain with redirect= has no all of its own, and the checker will flag it even if the target record is strict. If that's your setup and the target ends in ~all or -all, you can leave it.

No DMARC record

Fix soon Shown in the checker's Email & domain tab as “No DMARC record for yourdomain.com”.

The checker looks up the TXT record at _dmarc.yourdomain.com and flags the domain when none starts with v=DMARC1.

Why it matters

SPF and DKIM on their own don't say what a receiver should do when a check fails, and neither one ties the result to the address people actually see in the From line. DMARC does both. It passes only when SPF or DKIM passes for a domain that matches the visible From address (this is called alignment). Since February 2024, Gmail has required SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, with p=none accepted. Yahoo requires the same from bulk senders. Both also require one-click unsubscribe on marketing mail and a spam-complaint rate below 0.3%.

How to fix it

Set up SPF and DKIM first. Google advises letting them run for 48 hours before adding DMARC. Then add a TXT record with the host _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none means monitor only. rua is where receivers send daily aggregate reports: XML files that list which servers sent mail as your domain and whether each passed. A dedicated mailbox or a free DMARC report reader makes them readable. See Google: set up DMARC or Microsoft: set up DMARC.

DKIM: the one the checker can't see

DKIM is switched on inside your email provider, which then gives you a TXT or CNAME record to add to DNS. In Google Workspace it's the Admin console's Gmail settings, under Authenticate email; choose a 2048-bit key if your DNS host supports it (Google: set up DKIM). In Microsoft 365 it's the DKIM tab of Email authentication settings in the Microsoft Defender portal. Turn on DKIM for newsletter and booking tools too, so their mail passes DMARC under your domain.

DMARC is set to monitor only (p=none)

Minor Shown in the checker's Email & domain tab as “DMARC policy is p=none (monitor only)”.

The checker flags a DMARC record that contains p=none. When the policy is quarantine or reject and SPF is in place, the tab instead notes that SPF and DMARC are present and enforcing.

Why it matters

p=none is the right first step, but it only watches. Forged mail that fails every check is still delivered. You get reports about it, and your customers get the phishing.

How to fix it

Roll out enforcement in stages, as Google's recommended DMARC rollout describes:

Monitor: keep p=none for at least a week and read the reports. Every service that legitimately sends as you should pass. Fix any that don't by adding them to SPF or turning on their DKIM.
Quarantine: change to v=DMARC1; p=quarantine; rua=mailto:[email protected]. Failing mail now goes to spam. Watch the reports for another few weeks.
Reject: change to p=reject. Failing mail is refused outright, which is the full protection.

Older guides, including Google's and Microsoft's, ramp up with a pct= percentage. The DMARC standard was revised in May 2026 as RFC 9989, which retires pct and adds a t=y test flag instead. Until receivers have caught up, the simplest safe path is the three whole steps above.

How to check it's fixed

Look up the records with nslookup -type=txt yourdomain.com and nslookup -type=txt _dmarc.yourdomain.com, or run the website checker again. New records usually show up within minutes; a change to an existing record can take as long as its TTL (often an hour) to reach everyone. To check DKIM and alignment on a real message, send one to a Gmail account and choose Show original: SPF, DKIM and DMARC should each say PASS.

Sources

Common questions

Do I need SPF, DKIM and DMARC if I only send a few emails a day?

Gmail and Yahoo require at least SPF or DKIM from every sender, and all three only from bulk senders. But DMARC is what stops strangers from forging your domain, so it's worth adding whatever your volume.

Can I have two SPF records?

No. Two SPF records on the same domain cause a permanent error and SPF can't pass for any of your mail. Merge them into one record with an include: for each service.

Should my SPF record end in ~all or -all?

Either is fine once DMARC is in place. Google recommends ~all (softfail) and Microsoft's examples use -all (fail). Avoid +all and ?all, which protect nothing.

Will p=reject stop my own emails being delivered?

Only if a service that sends as you isn't covered by SPF or DKIM. That's why you start at p=none and read the reports first: they list every server sending as your domain, so you can fix the gaps before enforcing.

What is a DMARC aggregate report?

A daily XML file that mailbox providers send to the address in your rua= tag. It lists which IP addresses sent mail using your domain and whether each passed SPF, DKIM and DMARC. It doesn't contain the messages themselves.

How long does it take for SPF or DMARC changes to work?

New records usually show up within minutes. Edits to existing records can take up to the record's TTL, often an hour. Check with nslookup or the website checker before relying on them.

Check your whole domain. The website checker reads your MX, SPF and DMARC records and your domain's expiry date, alongside your website's security, speed and SEO. Branded business email is one of the things we set up and manage, if you'd rather hand it over.