SPF, DKIM and DMARC for small business owners

SPF, DKIM and DMARC are three short records in your domain's settings that let other mail services check that an email with your address on it really came from you. SPF lists the servers allowed to send your mail, DKIM puts a tamper-proof signature on each message, and DMARC tells receivers what to do when a message fails and sends you reports about it. You set each one up once, usually by copying values from your email provider, and they keep working in the background.

Why these records exist

Email was designed decades ago with no way to prove who sent a message. Anyone can type "[email protected]" in the From line. Scammers do exactly that, sending fake invoices that appear to come from real businesses. These three records are the fix that was added on top: your domain publishes facts about its own mail, and receiving servers compare each message against them.

For you, the practical result is that your real messages are trusted and fakes using your name are not.

SPF: the guest list

SPF (Sender Policy Framework) is a TXT record on your bare domain. Its value is a list of who may send mail for you.

A typical one for a business on Google Workspace looks like this:

"v=spf1 include:_spf.google.com ~all"

Reading it left to right:

"v=spf1" says "this is an SPF record".
"include:_spf.google.com" says "Google's mail servers may send for me".
"~all" says "anything else is probably not me, treat it with suspicion". A stricter version, "-all", says "anything else is definitely not me".

If you also send invoices through a billing tool and newsletters through a mailing service, each one adds its own "include:" entry, all in the same record:

"v=spf1 include:_spf.google.com include:servers.example-billing.com ~all"

Rules that trip people up:

Only one SPF record per domain. Two separate "v=spf1" records make both invalid. Merge them into one line.
A limit on lookups. Each "include:" makes the receiver look something up, and SPF allows only ten lookups in total. A record stuffed with every tool you ever tried can quietly break. Remove services you no longer use.
SPF checks the hidden sender address, not the From line you see, which is one reason it is not enough alone.

DKIM: the wax seal

DKIM (DomainKeys Identified Mail) signs every outgoing message with a private key held by your email provider. Your DNS holds the matching public key, so a receiving server can check that the signature is genuine and the message was not altered on the way.

You do not write DKIM records yourself. You turn DKIM on in your provider's admin page and it hands you a record to add. It has a name that includes a selector and "_domainkey", for example:

"google._domainkey" as a TXT record with a long value starting "v=DKIM1; k=rsa; p=..." for Google Workspace.
"selector1._domainkey" and "selector2._domainkey" as CNAME records for Microsoft 365.

Each service that sends for you can have its own DKIM record with its own selector, so they never clash. Paste the value exactly; a missing character breaks the signature. Some DNS editors split long values in two, which is normal.

DMARC: the instructions and the report

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at "_dmarc.yourdomain.com". It does two things.

First, it ties the other two checks to the address customers actually see. A message passes DMARC only if SPF or DKIM passes and matches the domain in the From line. That closes the gap where a scammer passes SPF for their own domain while showing yours.

Second, it tells receivers what to do with failures:

"p=none": deliver as usual, just report. The right place to start.
"p=quarantine": put failing messages in spam.
"p=reject": refuse failing messages outright.

A starting record looks like this:

"v=DMARC1; p=none; rua=mailto:[email protected]"

The "rua" address receives daily summary reports from big mail services. They arrive as zipped data files that are hard to read by eye; free report readers exist, or you can leave the reports going to an address you rarely check. They are useful mainly when something goes wrong.

What Gmail and Yahoo expect since 2024

In early 2024 Gmail and Yahoo tightened their rules for anyone sending to their users:

Everyone should have SPF or DKIM set up for their domain, and a valid DNS setup for the sending server.
Bulk senders, which Google defines as sending more than about 5,000 messages a day to Gmail addresses, must have SPF, DKIM and DMARC, a one-click unsubscribe link in marketing mail, and a very low rate of spam complaints.

Most small businesses are nowhere near the bulk level, but meeting the full set anyway costs nothing and protects you if a newsletter grows. Google's own guidance is on support.google.com.

How to check yours

In Gmail, open a message you sent, click the three dots, choose Show original, and read the SPF, DKIM and DMARC lines.
In your DNS settings, look for one TXT record starting "v=spf1", at least one "_domainkey" record, and a TXT record at "_dmarc".
In your email provider's admin page, look for a DNS or domain status screen that confirms the records it expects.

If messages are already landing in spam and you are not sure records are the cause, why your business emails go to spam covers the other usual reasons. And if your website is about to move, keep these records exactly as they are; MX records and why a website change can break email lists everything to protect.

Your setup checklist

Ask your email provider for its SPF entry and add it to a single SPF record.
Add "include:" entries for every other tool that sends as you, and remove old ones.
Turn on DKIM in your provider's admin page and add its record. Repeat for each sending tool that offers it.
Add a DMARC record at "p=none" with a report address.
Send test messages and check all three pass.
A few weeks later, consider moving DMARC to "quarantine".

If your website's contact form is one of the things sending as you, it needs to pass these checks too. You can see your site rebuilt first and test its form before you switch anything over.