SPF, DKIM and DMARC: Set Up Email on Your Own Domain
Email from your own domain needs three DNS records to be trusted: SPF says who may send it, DKIM signs it, and DMARC says what to do when a message fails. Here are the records, the common mistakes and how to check them.
Key points
- SPF lists the servers allowed to send mail for your domain; DKIM adds a signature receivers can verify; DMARC tells receivers what to do with mail that fails, and reports back.
- Publish exactly one SPF record, include every service that sends as you, and stay within SPF's limit of 10 DNS lookups.
- Each sending service signs with its own DKIM key, published under its own selector.
- Start DMARC at p=none, read the reports, then tighten to quarantine and reject.
- Gmail and Yahoo have required authentication since February 2024, and Microsoft's consumer mailboxes since May 2025.
To be trusted, email sent from your own domain needs three DNS records: SPF, which lists the servers allowed to send it; DKIM, which signs every message with a key published in DNS; and DMARC, which tells receiving servers what to do with a message that fails both, and where to send reports. Without them, your messages are easy to forge and far more likely to land in spam.
Why this matters now
Since February 2024, Gmail and Yahoo have required every sender to authenticate their mail, and senders of bulk mail — around 5,000 messages a day or more — to have SPF, DKIM and DMARC in place. Microsoft applied the same rules to its consumer mailboxes (Outlook.com, Hotmail and Live) from May 2025. Even if you send a few messages a day, unauthenticated mail from a business domain looks suspicious to every large provider. Google explains its rules in its email sender guidelines.
SPF: who may send mail for your domain
SPF (Sender Policy Framework) is one TXT record on your domain itself. It lists the servers and services that may send mail with your domain in the envelope sender. A typical record:
yourshop.com. TXT "v=spf1 mx include:_spf.google.com -all"v=spf1starts the record.mxallows the servers in your MX records;awould allow your website's server;ip4:allows a fixed address;include:brings in another service's list (your newsletter tool, a helpdesk, Google Workspace).-allsays everything else fails;~allsays everything else is suspicious ("soft fail"). Start with~allif you are not sure you have listed every sender, then move to-all.
The SPF mistakes that break mail
- Two SPF records. A domain may have only one. Two records make SPF fail for every message. Merge them into one.
- More than 10 DNS lookups. Every
include,a,mxandexistscosts a lookup, and includes inside includes count too. Past ten, SPF fails (RFC 7208). Remove services you no longer use. - A forgotten sender. Your website's contact form, your invoicing system or your shop software may send mail as your domain. List each one.
Our SPF record generator builds a record from the services you tick and counts its lookups for you.
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The sending server keeps a private key; you publish the matching public key in DNS, under a name made of a selector and _domainkey:
mail._domainkey.yourshop.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."The receiving server reads the selector from the message, fetches the key and checks that the message was signed by your domain and not changed on the way. You never write a DKIM key yourself: your mail host or sending service generates it and shows you the record to publish. Each service that sends for you gets its own selector, so you can have several DKIM records at once. Use 2048-bit keys where the service offers them.
DMARC: the policy and the reports
DMARC ties the other two to the address people actually see — the From domain. A message passes DMARC when SPF or DKIM passes and the domain they checked matches the From domain ("alignment"). The record lives at _dmarc on your domain:
_dmarc.yourshop.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourshop.com"p=noneasks receivers only to report;p=quarantineasks them to put failing mail in spam;p=rejectasks them to refuse it.rua=is where daily aggregate reports go: which servers sent mail as your domain, and whether it passed.
Roll DMARC out in three steps
- Publish
p=noneand read the reports for two to four weeks. Every legitimate sender should pass; fix any that do not. - Move to
p=quarantine. Forged mail now goes to spam. - Move to
p=reject. Forged mail is refused outright, and nobody can send convincing phishing from your domain.
The DMARC record generator writes the record for whichever step you are at.
Do not forget MX
SPF, DKIM and DMARC are about mail you send. To receive mail, your domain also needs MX records pointing at the server that holds your mailboxes. If you move your domain to new nameservers, copy the MX records too — see how to change nameservers without breaking email.
How to check your setup
- Run your domain through the MX, SPF and DMARC checker. It reads your MX, SPF, DKIM and DMARC records and explains every problem it finds, such as two SPF records or too many lookups.
- Send a message to a Gmail address, open it, choose Show original, and look for
SPF: PASS,DKIM: PASSandDMARC: PASS.
Email on your domain at Hostular
Hostular plans include mailboxes on your own domain, with forwarders and autoresponders. When your domain uses our nameservers, the SPF, DKIM and DMARC records for its mail are published in its DNS zone for you; the private DKIM key stays on the mail server. If your DNS is somewhere else, copy the records your panel shows into that DNS host. Either way, run the checker afterwards. The number of mailboxes on each plan is on the pricing page.
Still landing in spam after all three pass? Read why emails go to spam and how to fix it.
Questions and answers
Do I need SPF, DKIM and DMARC for a small business?
Yes. Gmail and Yahoo require every sender to authenticate, and stricter rules apply to bulk senders. Even at a few messages a day, mail from a business domain without them is more likely to be marked as spam, and easier for others to forge.
Can I have two SPF records?
No. A domain may publish only one SPF record. Two make SPF fail for every message. Combine all your senders into one record, keeping it within 10 DNS lookups.
What DMARC policy should I start with?
Start with p=none and a reporting address, read the reports for a few weeks, fix any legitimate sender that fails, then move to p=quarantine and finally p=reject.
Where do I get my DKIM record?
From whoever sends your mail. Your mail host or sending service generates the key pair and shows you the TXT record to publish under its selector. You never create the key yourself.
How do I check whether SPF, DKIM and DMARC are working?
Use an MX, SPF and DMARC checker on your domain, and send yourself a message at Gmail: under Show original it lists the SPF, DKIM and DMARC result for that message.
