Setting up SPF, DKIM and DMARC: the 2026 guide

When an email arrives, the receiving server first asks: is this sender allowed to send on behalf of this domain? Three DNS-based methods answer that – SPF, DKIM and DMARC. Since Gmail and Yahoo made them mandatory for bulk senders in 2024, they are no longer optional. This guide explains what each checks, what the records look like and the order to roll them out without losing legitimate mail.

SPF: who may send for the domain?

The Sender Policy Framework is a TXT record listing the servers allowed to send for a domain:

v=spf1 include:_spf.example-provider.com ip4:203.0.113.10 -all

An often overlooked detail: SPF does not check the visible From address but the envelope sender (return path) that bounces go to. Many services use a dedicated subdomain for it, such as send.your-domain.com.

• Only one SPF record per name. Two v=spf1 records invalidate SPF.
• At most 10 DNS lookups. Every include, a and mx counts. Exceed it and SPF fails with “permerror”.
• -all (hard) or ~all (soft) defines how unlisted servers are treated. Together with DMARC, ~all is usually enough.

DKIM: is the message unaltered and signed by the domain?

DomainKeys Identified Mail signs every message cryptographically. The sending server holds the private key; you publish the public key as a TXT record under a selector:

ridu-6fe0._domainkey.your-domain.com  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg…"

The receiver reads the selector from the signature, fetches the key via DNS and verifies that headers and body are unchanged. Because the signature is tied to the content rather than the server, DKIM usually survives forwarding – unlike SPF.

• Use 2048-bit RSA keys; 1024 bits are considered too weak.
• Long keys exceed the 255-character limit of a DNS string. Good DNS interfaces split them automatically; check nothing was truncated.
• Give every service its own selector so keys can be rotated individually.

DMARC: what happens when checks fail?

DMARC ties SPF and DKIM to the visible sender address. A message passes when SPF or DKIM passes and the checked domain matches the From domain (“alignment”). With the usual relaxed alignment the same organizational domain suffices: send.your-domain.com aligns with your-domain.com.

_dmarc.your-domain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com"

The policy p tells receivers what to do with failing mail: none (report only), quarantine (spam folder) or reject. Via rua you receive daily aggregate reports of who sent on your behalf.

The safe order

1. Inventory: which systems send with your domain? Newsletter tool, shop, CRM, help desk, office mailboxes.
2. DKIM for every service – the most robust building block.
3. Consolidate SPF without breaking the 10-lookup limit.
4. Publish DMARC with p=none and a report address. Review reports for two to four weeks.
5. When all legitimate sources pass: p=quarantine, later p=reject. pct=25 lets you tighten gradually.

Common mistakes

• A second SPF record because a service ships its own template.
• Cloudflare's proxy (orange cloud) enabled on a CNAME – mail records must be “DNS only”.
• The DKIM key got truncated or pasted with line breaks.
• Subdomains sending without their own authentication fail once DMARC gets strict. sp= sets a separate subdomain policy.

Checking the result

Send a test to a Gmail mailbox and open “Show original”. It lists SPF: PASS, DKIM: PASS and DMARC: PASS with the checked domain. If one is missing, the Authentication-Results header tells you why.