How to set up SPF, DKIM and DMARC records

Last updated 13 October 2026 · By the XKey team

What do SPF, DKIM and DMARC do?

• SPF lists the services allowed to send email for your domain.
• DKIM adds a digital signature to each email so receivers can check it wasn't forged or changed.
• DMARC tells receivers what to do when an email fails those checks, and sends you reports about who is sending as your domain.

You add all three where your domain's DNS is managed – often your domain registrar (GoDaddy, IONOS, 123 Reg, Namecheap) or Cloudflare. Our DNS lookup shows who hosts your DNS.

How do I set up SPF?

Add one TXT record on your root domain (shown as @). Start it with v=spf1, add an include for each service that sends email for you, and end with ~all or -all:

• Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
• Google Workspace: v=spf1 include:_spf.google.com ~all
• Both, plus a newsletter tool: one record with several includes, using the include each provider gives you in its help pages.

Never create two SPF records – combine them into one. Keep under 10 DNS lookups in total. Test it with the SPF checker.

How do I set up DKIM?

• Microsoft 365: in the Microsoft Defender portal, open Email authentication settings → DKIM, choose your domain, copy the two CNAME records it shows (selector1 and selector2) into your DNS, then switch signing on.
• Google Workspace: in the Admin console, go to Apps → Google Workspace → Gmail → Authenticate email, generate a key, add the TXT record it shows (usually at google._domainkey), then press Start authentication.
• Other services (Mailchimp, Xero, booking systems): look for "authenticate your domain" in their settings; each gives you its own records.

Check each one with the DKIM checker using the selector your provider gave you.

How do I set up DMARC?

Add a TXT record named _dmarc. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk

Reports arrive at that address showing every service sending as your domain. Once everything you use passes SPF or DKIM, tighten the policy to p=quarantine, then p=reject, which stops others sending forged emails as your business. Check it with the DMARC checker, and see how to set up DMARC for reading reports and moving safely to p=reject.

What are the most common setup mistakes?

• Two SPF records instead of one.
• Forgetting a service, such as a website contact form or invoicing app.
• Jumping straight to p=reject before checking reports, so real emails get blocked.
• Typing the record name as _dmarc.example.co.uk in a DNS panel that adds the domain itself, creating _dmarc.example.co.uk.example.co.uk.

Still landing in spam after this? See why are my emails going to spam?.

Frequently asked questions

How long do SPF, DKIM and DMARC take to work?

Usually within an hour, although DNS changes can take up to 48 hours to reach everywhere.

Do I need DMARC if I only send a few emails?

It's strongly recommended. It's free, protects your name from being used in scam emails and helps your emails reach the inbox.

Does a domain that never sends email need these records?

Yes – add an SPF record of v=spf1 -all and a DMARC record with p=reject so nobody can send forged email from it.