How to Set Up SPF, DKIM, and DMARC for a Small Business Domain

To set up SPF, DKIM, and DMARC for a small business domain, list every service that sends mail as your domain, publish the DNS records each provider specifies, and test every sending stream. Start DMARC in monitoring mode and move to enforcement only after you identify and fix failures.

• SPF and DKIM authenticate sending services; DMARC checks whether either result aligns with the visible From domain.
• Inventory services that send from your main domain and its subdomains before changing DNS.
• Keep one SPF record per domain and stay within SPF’s 10-lookup limit.
• Start DMARC with p=none, review reports, and enforce gradually only when legitimate mail is covered.
• Authentication supports deliverability but does not guarantee inbox placement.

What do SPF, DKIM, and DMARC do?

SPF identifies services authorized to send mail for a domain. DKIM adds a cryptographic signature that authenticates a domain and helps verify that a message was not altered in transit. DMARC checks whether SPF or DKIM passes and aligns with the domain in the visible From address. It also lets the domain owner request reports and state how receiving services should handle messages that fail. ^{[1] [2]}

Google’s baseline guidance calls for SPF or DKIM for all senders. Senders sending 5,000 or more messages per day to personal Gmail accounts need SPF, DKIM, and DMARC. ^[3] These requirements do not mean that authentication alone guarantees inbox placement. ^[4]

Which services should you include before changing DNS?

Include every service that sends using your domain, including services that use a subdomain such as news.example.com. A forgotten sender can fail authentication or be affected by a stricter DMARC policy.

1. List your mailbox provider, newsletter platform, website or contact-form sender, invoicing or booking software, CRM, and transactional-email service.
2. For each service, record the domain in the visible From address, the domain used for SPF sending (often the return-path or MAIL FROM domain), and the DKIM signing domain. Also note the provider’s SPF instructions, DKIM selector and record, and any sending subdomain.
3. Check current DNS records and the provider’s latest setup instructions for exact record names and values. Google’s SPF guidance directs domain owners to their DNS host to add the record. ^[5]

DMARC alignment is why these domains matter: an SPF pass for a provider’s unrelated sending domain may not align with your visible From domain. DKIM can provide the aligned result instead if its signing domain matches. Cloudflare describes a DNS setup flow for its customers; use your own DNS provider’s interface and instructions. ^[1]

How do you set up SPF and DKIM correctly?

Publish the records each sending provider specifies. Do not copy another business’s record values; they depend on the provider and domain.

1. Sign in to your DNS host and locate existing TXT records. Identify and save the current SPF record before editing.
2. Update that SPF record to include active senders according to provider instructions. Do not create a second SPF record; remove obsolete entries. ^[6]
3. Add each provider’s DKIM record using its exact host or selector and value. Enable DKIM signing in the service if required.
4. Check the combined SPF setup. SPF evaluation has a limit of 10 DNS-querying terms. Remove obsolete senders and check lookup use instead of adding services blindly. ^[7]
5. Allow DNS changes to appear, then test each service. Google notes that SPF authentication can take up to 48 hours to start working after adding a record. ^[6]

How should you publish DMARC without disrupting email?

Publish a monitoring record first. In your DNS host, create a TXT record with _dmarc as the host or name. For example:

Type: TXT
Host/name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

This is illustrative: replace example.com and the example mailbox with your domain and an address or reporting service your business controls. Make sure you can access the mailbox or dashboard. Aggregate DMARC reports are usually machine-readable XML, so a small business can use a DMARC reporting dashboard or XML parser to turn them into a readable view of sources and authentication results. Reports and their timing depend on receiving providers; do not expect a report for every test message.

Google recommends setting up SPF and DKIM at least 48 hours before DMARC. ^[8] Review reports during an initial monitoring period; Google recommends starting with p=none for one week before considering a limited quarantine rollout. ^[8] Do not move to enforcement until you have identified all legitimate sending sources, resolved unexplained failures, and confirmed aligned SPF or DKIM authentication for each business sending stream over a representative period.

To start a limited rollout, add a percentage tag to the record, for example: v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@example.com. The 10% value is an example, not a universal starting point; Google gives it as an illustration for a small organization. ^[8] Increase enforcement in stages only while legitimate mail remains unaffected. If legitimate messages are quarantined or rejected, pause the rollout or return to monitoring while you investigate and correct the sender configuration.

How do you test the records and fix failures?

DNS checks help confirm records are present, but they do not replace testing messages sent through each service.

1. Send a message from each inventoried service to an inbox where you can inspect message details.
2. Open the message’s original or full headers and find the Authentication-Results header. Check the SPF, DKIM, and DMARC results. A successful DMARC result requires at least one passing SPF or DKIM result that aligns with the visible From domain.
3. If SPF or DKIM passes but DMARC fails, check alignment. Compare the SPF-authenticated sending domain and DKIM signing domain with the From domain; ask the provider how to align its return-path or signing domain, then retest.

For example, if a newsletter passes DKIM but fails DMARC, check whether the DKIM signing domain aligns with the newsletter’s visible From domain. Keep p=none until the service produces an aligned result and your tests confirm it. Google Postmaster Tools is an optional way to monitor Gmail delivery and spam-related signals, particularly for higher-volume senders; it is not a delivery guarantee. ^[9]

What is the final setup checklist for a small business?

• Inventory senders on the main domain and subdomains; note each From, SPF, and DKIM domain.
• Update one SPF record, add provider-specific DKIM records, and test a message from every service.
• Publish DMARC with p=none and a controlled reporting address.
• Review reports, fix unexplained failures, and enforce gradually only after aligned results are confirmed.

Frequently asked questions

Can I use more than one SPF record on the same domain?

No. Keep one SPF record for the domain and update it to include active authorized senders; remove obsolete entries. ^[6]

Do SPF, DKIM, and DMARC guarantee inbox delivery?

No. These records support authentication and help meet provider requirements, but they do not guarantee inbox placement. ^[4]

References

• ^[4] Provider guidance on authentication and delivery consequences.
• ^[3] Google baseline and bulk-sender authentication guidance.
• ^[8] Google guidance on DMARC setup and gradual enforcement.
• ^[7] RFC 7208, SPF DNS-query limit.
• ^[6] Google SPF setup and troubleshooting guidance.
• ^[1] DMARC overview and Cloudflare DNS setup guidance.
• ^[5] Google SPF guidance on adding records through a domain host.