Email Deliverability

How to Set Up SPF, DKIM and DMARC for a New Sending Domain

A step-by-step guide for sales and marketing teams to add SPF, DKIM and DMARC records to a new sending domain, test them in Gmail, and move DMARC from p=none to enforcement.

Rupinder Kaur

— 4 min read
Share

This guide walks you through the three DNS records that prove your email really comes from your domain. By the end, your new sending domain will have a working SPF record, DKIM signing, and a DMARC policy that starts in monitoring mode and moves to enforcement when you are ready.

What you need

  • Login access to your DNS host, where you manage your domain's records.
  • Admin access to every tool that sends email as your domain.
  • A mailbox or group address to receive DMARC reports, for example [email protected].

Here is what each record does:

  • SPF lists the servers that are allowed to send email for your domain.
  • DKIM adds a digital signature to each message. Receivers check it against a public key you publish in DNS.
  • DMARC tells receivers what to do when a message fails those checks, and sends you reports about your mail.

What Google and Yahoo require

According to Google's email sender guidelines, everyone sending to Gmail accounts must set up SPF or DKIM and keep the spam rate in Postmaster Tools below 0.3%. If you send more than 5,000 messages per day to Gmail accounts, you must also:

  • Set up both SPF and DKIM.
  • Set up DMARC. Google says the policy can be set to none.
  • Make sure the From: domain is aligned with either the SPF domain or the DKIM domain.
  • Support one-click unsubscribe on marketing and subscribed messages, with a visible unsubscribe link in the body.

Yahoo's sender requirements are similar. All senders need SPF or DKIM at a minimum and a spam rate below 0.3%. Bulk senders need both SPF and DKIM, a valid DMARC policy of at least p=none that passes, one-click unsubscribe, and must honor unsubscribes within 2 days.

Step 1: Set up SPF

  1. Find the SPF "include" value for each sending service in its help pages.
  2. Combine them into one TXT record at the root of your domain. Most DNS hosts use @ as the host name for the root.
Type:  TXT
Host:  @
Value: v=spf1 include:_spf.provider-one.example.com include:mail.provider-two.example.com ~all

The ~all at the end is a "softfail". It tells receivers that other servers are probably not authorized. Google recommends ~all and says SPF can take up to 48 hours to start working. A stricter ending, -all, is an explicit "fail" under the SPF standard (RFC 7208).

Step 2: Set up DKIM

  1. In each sending tool, find the DKIM or "authenticate domain" setting and generate a key.
  2. Choose a 2048-bit key if your DNS host supports it. Google says sending to personal Gmail accounts requires a key of 1024 bits or longer and recommends 2048 bits.
  3. Copy the host name and value the tool gives you into a new TXT record. The host is made of a "selector" plus ._domainkey.
  4. Once the record is in place, go back to the tool and turn on signing. Google says DKIM can take up to 48 hours to start working.
Type:  TXT
Host:  selector1._domainkey.example.com
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

Each tool usually has its own selector, so several DKIM records is normal. The DKIM standard (RFC 6376) stores all keys under _domainkey.

Step 3: Publish DMARC at p=none

Google advises you to allow 48 hours after setting up SPF and DKIM before you add DMARC. Then add this TXT record:

Type:  TXT
Host:  _dmarc.example.com
Value: v=DMARC1; p=none; rua=mailto:[email protected]
  • v and p must come first. Other tags can follow in any order.
  • p=none means mail is delivered as normal, and you receive reports.
  • rua is the address that receives aggregate reports about your mail.

Step 4: Move to quarantine, then reject

Google's recommended DMARC rollout works like this:

  1. Keep p=none for one week. Review your reports and fix any real sending tool that fails SPF or DKIM.
  2. Move to p=quarantine for a small percentage of messages using the pct tag. Google suggests a small organization might start with 10%. Receivers may quarantine failing mail.
  3. Raise the percentage over time until it covers 100% of messages.
  4. If you need stricter handling, change the policy to p=reject. Receivers are asked to refuse mail that fails.
v=DMARC1; p=quarantine; pct=10; rua=mailto:[email protected]
v=DMARC1; p=reject; rua=mailto:[email protected]

dmarc.org describes the same path.

How to check it works

  1. Send a test email from each sending tool to a Gmail address on a different account. Google notes you can't verify DKIM by sending yourself a test message.
  2. Open the message in Gmail on a computer. Next to Reply, click More, then Show original. The full header opens in a new window.
  3. Find the Authentication-Results line. You want to see spf=pass, dkim=pass and dmarc=pass. This header format is defined in RFC 8601.
  4. If there is no DKIM result at all, Google says your messages are not being signed. Go back to Step 2.
  5. Check that the d= value in the DKIM-Signature header is the same domain as your From: address.

Common mistakes

  • More than one SPF record. If a domain has two v=spf1 records, the result is a "permerror" under RFC 7208. Merge all providers into one record.
  • Going over 10 DNS lookups. SPF allows at most 10 terms that trigger DNS lookups: include, a, mx, ptr, exists and redirect. Includes inside your providers' records count too. Going over returns "permerror". Remove services you no longer use.
  • Jumping straight to p=reject. Mail from a sending tool you forgot about can be refused. Start at p=none.
  • Misaligned domains. If your tool signs with its own domain instead of yours, DKIM may pass but DMARC can still fail.

Sources

Read more