Skip to Content

How to Set Up DMARC, SPF and DKIM for a Small Business

Stop other people sending email as your domain, in six steps, without breaking the email you send yourself.

Anyone can send an email that claims to come from your domain. SPF, DKIM and DMARC are three DNS records that let receiving mail servers check whether a message really came from you, and tell them what to do when it did not. Set up in the right order, they stop others sending mail as your exact domain, without blocking your own mail.

Since 2024, Gmail and Yahoo also require SPF, DKIM and DMARC from anyone sending large volumes of mail to their users, so missing records can hurt your own delivery too.

What each record does

  • SPF lists the servers allowed to send mail for your domain.
  • DKIM adds a signature to each message that proves your domain sent it and that it was not changed on the way.
  • DMARC tells receivers what to do when a message fails those checks, and sends you reports about who is sending as your domain.

None of them stop look-alike domains, such as examp1e.com. They protect the domain you actually own.

All three are TXT records you add wherever your domain’s DNS is managed: your registrar, Cloudflare, or your web host.

Step 1. List everything that sends email as you

This is the step people skip, and it is the one that breaks things later. Check each of these:

  • Your mailbox provider, such as Microsoft 365 or another email host.
  • Your website: contact forms, order confirmations, password resets.
  • Your newsletter tool.
  • Your invoicing, CRM, booking or help desk software.
  • Your online shop or point of sale, if it emails receipts.

Step 2. Publish one SPF record

Each sending service tells you what to add, usually an include:. Combine them into one record at the root of your domain:

example.com  TXT  "v=spf1 include:spf.protection.outlook.com include:spf.example.org ~all"

The first include is Microsoft 365’s; the second stands in for any other service. Use the ones your own services give you. Rules that trip people up:

  • Only one SPF record per domain. Two records means SPF fails for everything.
  • SPF allows at most 10 DNS lookups. Each include: counts, and some count more than once. Too many and SPF fails.
  • End with ~all while you are setting up. DMARC does the enforcing later.

Step 3. Turn on DKIM for every sender

Each service generates its own DKIM key and gives you one or more records to add, usually under a name like selector._domainkey.example.com. Add them, then switch DKIM on in that service’s settings. Make sure the signature uses your domain, not the service’s own. That match, called alignment, is what DMARC checks.

Step 4. Publish DMARC in monitoring mode

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p=none changes nothing about delivery. It only asks receivers to send daily reports to the rua address. Use a mailbox set aside for this, because the reports arrive as compressed XML files and there can be many of them. A DMARC report reader turns them into something readable.

Step 5. Read the reports for two to four weeks

The reports show every server that sent mail as your domain, and whether it passed. For each source that fails:

  • If it is yours, such as a forgotten newsletter tool, add it to SPF and set up its DKIM.
  • If it is not yours, that is the impersonation DMARC is about to stop.

Step 6. Enforce

When everything legitimate passes, tighten the policy in stages:

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Quarantine sends failing mail to spam. Watch the reports for another couple of weeks, then move to reject, which tells receivers to refuse it outright:

_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Keep reading the reports after that. Adding a new email tool later means adding it to SPF and DKIM before it goes live.

Domains that never send email

Old or parked domains are easy to impersonate because nobody watches them. If a domain sends no mail at all, say so:

example.net  TXT  "v=spf1 -all"
_dmarc.example.net  TXT  "v=DMARC1; p=reject"

Common mistakes

  • Two SPF records instead of one combined record.
  • Going straight to p=reject and losing invoices or receipts sent by a tool nobody listed.
  • A service signing with its own domain instead of yours, so DKIM passes but DMARC still fails.
  • Sending reports to a personal inbox, which then fills with XML files.
  • Setting p=none and never coming back. Monitoring mode reports impersonation; it does not stop it.

Want it done for you?

Cyber Insurance Questions: What Insurers Ask and How to Answer
The controls a cyber insurance application commonly asks about, what each question really means, and how to check your answer before you sign.