Why it matters
Email without authentication looks like spoofing, so it goes to spam or is rejected outright. Since 2024, Gmail and Yahoo have required SPF or DKIM from every sender, and SPF, DKIM, DMARC and one-click unsubscribe from anyone sending several thousand emails a day.
SPF
Add one TXT record to your domain. Having two SPF records is an error, so put every service that sends for you into the same record.
| Provider | Example SPF record (TXT, @) |
|---|---|
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Both + another service | v=spf1 include:_spf.google.com include:service.example ~all |
Check against your provider's current documentation, and stay under the limit of 10 DNS lookups.
DKIM
- Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key, publish the TXT record (for example google._domainkey) and click Start authentication.
- Microsoft 365: in the email authentication settings of the Microsoft Defender portal, turn on DKIM for your domain and publish the two CNAME records (selector1 and selector2).
- Wait for DNS to update (anything from minutes to 48 hours), then check that signing is switched on.
DMARC
Add a TXT record at _dmarc. Start in monitoring mode, read the reports for a few weeks, then tighten the policy.
- Start: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Next: p=quarantine (failing email goes to spam)
- Goal: p=reject, once every legitimate sender passes
How to check
Send yourself an email, open it in Gmail and choose “Show original”. SPF, DKIM and DMARC should all say PASS. When you connect a mailbox, Repmight checks your domain's records and tells you what's missing.
Common mistakes
- More than one SPF record
- Adding a new sending service and forgetting to add it to SPF
- Publishing the DKIM record but never switching signing on
- Going straight to p=reject without reading the reports
FAQ
Do I need all three?
If you send in small numbers, SPF or DKIM is technically enough to pass. Setting up all three is still the safest choice for deliverability, and bulk senders have to.
Is DMARC p=none enough?
It's a good place to start, because you can watch what happens. Once the reports show all your legitimate email passing, moving to quarantine or reject protects your domain from spoofing.