How to set up SPF, DKIM & DMARC to keep emails out of spam

If you’re doing cold email outreach, newsletters, or product updates, poor email deliverability means lost leads and missed revenue.

And the technical issues relating to SPF, DKIM, and DMARC set-up is one of the culprits behind it.

SPF, DKIM & DMARc are email authentication protocols (read “tools”)  that tell inbox providers like Gmail and Outlook that you are a trusted sender.

Without proper setup, even professional emails get marked as spam.

The payoff is measurable. In SmartReach.io’s State of Cold Email 2026 benchmarks, domains with SPF, DKIM, and DMARC on an enforcement policy were about 2.7x more likely to land in the inbox, and with warmed, aged domains, 85-95% inbox placement is achievable.

And here’s the edge: only about 7.6% of domains actually enforce DMARC. Most of your competitors still haven’t done this.

This guide shows you exactly how to set up SPF, DKIM & DMARC, step-by-step.

First thing first.

SPF vs DKIM vs DMARC: Email authentication protocols explained#

What is SPF?#

SPF (Sender Policy Framework) is an email authentication protocol that tells receiving mail servers which servers are allowed to send email for your domain.

Think of it as a guest list.

For example, if you send newsletters via Mailchimp and sales emails via Gmail, SPF tells inboxes both are legit sources.

Without it, anyone can pretend to send from your domain.

What is DKIM?#

DKIM (DomainKeys Identified Mail) is an email authentication method that adds an encrypted signature to every message you send, so receiving servers can verify the email genuinely came from your domain and wasn’t altered in transit.

Think of it as sealing a letter with a signature.

If someone tampers with the content in transit, the signature breaks and the email fails authentication.

What is DMARC?#

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy layer that sits on top of SPF and DKIM, telling inbox providers what to do when a message fails authentication: deliver, quarantine or reject.

Think of it as your bouncer.

It also sends you reports so you can spot issues or abuse attempts.

SPF vs DKIM vs DMARC: what each one does#

Together, they form your email’s authentication system. 

For more details on the email authentication protocols, check out –

What is email authentication, and why does it matter for my email deliverability?

How to set up email authentication: SPF, DKIM, DMARC tutorial#

Now let’s set-up these records one by one. Follow these steps carefully – 

A) Setting up SPF: Authorize your sending servers#

SPF setup means creating a DNS record that lists your authorized mail servers. 

Here’s exactly how to do it.

Step 1→ Find your current SPF record#

First, check if you already have an SPF record. 

You can only have one per domain.

Go to mxtoolbox.com/spf.aspx.

Enter your domain and see if you already have an SPF record. You can also run that check with our free SPF checker, which follows every include and counts all 10 DNS lookups. 

If you find one, you’ll modify it. If not, you’ll create a new one.

Step 2 →  Identify your email services#

List every email service that sends emails from your domain. 

This includes:

• Your email providers (Gmail, Outlook, Zoho etc.)
• Marketing tools (Mailchimp, Constant Contact)
• CRM systems (Salesforce, HubSpot)
• Transactional email services (SendGrid, Mailgun)
• Any other tools that send emails

Write them all down. 

Missing even one service will cause authentication failures.

Step 3 → Create or update your SPF record#

Your SPF record includes all these services. Here’s the commone format:

Common service includes:

• Google Workspace: include:_spf.google.com
• Microsoft 365: include:spf.protection.outlook.com
• Mailchimp: include:servers.mcsv.net
• SendGrid: include:sendgrid.net
• Constant Contact: include:spf.constantcontact.com

Each of those includes costs you part of the ten DNS lookups SPF allows, and they do not cost the same amount. Our measured table of SPF lookup costs gives the current figure for every major provider, with the date it was measured, so you can add up the record before you publish it rather than after it starts failing.

Real example for a company using Google and Mailchimp:

Example for just Google workspace accounts:

The ~all at the end is important. 

It tells email servers to flag suspicious emails but not reject them completely. Before moving on, you can use an SPF record checker to preview how your record will be interpreted by mail servers.

Note: Avoid +all. It allows anyone to send on your behalf.

Rather than assembling that string by hand, our free SPF record generator builds one valid record from the services you pick, and counts the ten DNS lookups the standard allows from each provider’s real record before you publish.

Step 4 → Add the SPF record to DNS#

Now add this record to your domain’s DNS settings. 

Log in to your domain registrar (GoDaddy, Namecheap, Cloudflare, etc).

The process varies by provider, but here’s the general approach:

A) For GoDaddy users:

1. Log into your GoDaddy account
2. Go to “My Products” then “DNS”
3. Click “Add” under DNS Records
4. Set Type to “TXT”
5. Set Name to “@”
6. Paste your SPF record in the Value field
7. Click “Save”

B) For Cloudflare users:

1. Log into Cloudflare
2. Select your domain
3. Go to the DNS tab
4. Click “Add record”
5. Set Type to “TXT”
6. Set Name to “@”
7. Paste your SPF record in Content
8. Click “Save”

C) For other domain providers: 

The steps are similar. 

1. Go to DNS settings
2. Add a TXT record
3. Name: @ or your root domain
4. Value: Your SPF string

Step 5 →  Test & verify the SPF record#

Wait 2-4 hours for DNS changes to take effect. 

Then test your record:

Go to MXToolbox.com. 

Enter your domain. Click “SPF Record Lookup.” 

You should see your new record listed.

Send a test email to yourself. 

Check the email headers. 

You should see “SPF: PASS” in the authentication results.

__________

B) Setting up DKIM: Add digital signatures to the emails#

DKIM requires generating encryption keys and adding them to your DNS. 

Your email service providers (Gmail, Outlook etc.) usually handles the technical parts. Where they do not, or where you sign your own mail, our free DKIM record generator produces the key pair locally in your browser and formats the TXT record ready to paste into DNS.

Step 1 → Generate DKIM keys in your email provider#

A) For Google Workspace:

1. Go to admin.google.com
2. Click “Apps” then “Google Workspace” then “Gmail”
3. Click “Authenticate email”
4. Click “Generate new record”
5. Enter a selector name (like “google” or “selector1”)
6. Choose 2048-bit key
7. Click “Generate”

Google will show you a DNS record to add. 

Copy this entire record.

B) For Microsoft 365:

1. Go to security.microsoft.com
2. Navigate to “Email & Collaboration” then “Policies & Rules”
3. Click “Threat policies” then “DKIM”
4. Select your domain
5. Click “Create DKIM keys”
6. Copy the provided DNS records

C) For other email providers:

Check your provider’s help documentation. Search for “DKIM setup” or “email authentication.”

Step 2 → Add DKIM records to DNS#

You’ll add the records your email provider gave you. 

They look complex, but you just copy and paste them.

The record name usually looks like: 

The record value starts with: v=DKIM1; k=rsa; p=

A) Add DKIM record in GoDaddy:

1. Go to DNS management
2. Click “Add” under DNS Records
3. Set Type to “TXT”
4. Set Name to the exact name provided (like “selector1._domainkey”)
5. Paste the entire value in the Value field
6. Click “Save”

B) Add DKIM records in Cloudflare:

1. Go to DNS tab
2. Click “Add record”
3. Set Type to “TXT”
4. Set Name to the provided name
5. Paste the value in Content
6. Click “Save”

Step 3 → Enable DKIM signing#

After adding the DNS records, enable DKIM in your email provider:

Google Workspace:

1. Go back to the “Authenticate email” section
2. Click “Start authentication” next to your domain
3. Wait for verification (can take up to 48 hours)

Microsoft 365:

1. Return to the DKIM section
2. Toggle the switch to “Enabled” for your domain

Step 4 → Verify DKIM is working#

Test your DKIM setup:

Use MXToolbox’s DKIM lookup tool, or our free DKIM checker. 

Enter your domain and selector. 

You should see your public key.

Send a test email. Check the headers for “DKIM: PASS” in the authentication results.

Checking headers one mailbox at a time gets old fast once you send from more than a couple of inboxes. SmartReach.io, a cold email software, runs SPF, DKIM and DMARC checks on every connected email account and shows the result beside each inbox, so a broken signature surfaces before a campaign goes out. For SMTP accounts it also generates the exact DKIM TXT record you need to paste into DNS.

The DKIM setup screen in SmartReach.io. It generates the TXT record, then confirms once DNS shows it.

If the status reads Inactive after you save the record at your DNS host, propagation simply has not finished. Re-check after a few hours and start sending only once it flips. The free DNS record checker from SmartReach.io reads every record on the domain at once and queries the mail records against six independent resolvers, so you can see whether the new TXT record has reached all of them or only some.

__________

C) Setting up DMARC: control and monitor email Use#

DMARC brings SPF and DKIM together. 

Step 1 → Start with a monitoring policy#

Create a basic DMARC record for monitoring first, something like:

• p=none: Monitor only, take no action yet
• rua: Where DMARC reports will be sent
• Replace “yourdomain.com” with your actual domain.

This record:

• Sets policy to “none” (monitoring only)
• Sends reports to your email address
• Doesn’t block any emails yet

Our free DMARC record generator builds this record for you and explains each tag as you set it, including the alignment and percentage options most guides leave out.

Step 2 → Set up email for reports#

Create an email address to receive DMARC reports. You can use:

• dmarc@yourdomain.com
• reports@yourdomain.com
• Any existing email address

These reports show you authentication results for all emails from your domain.

Step 3 → Add DMARC record to DNS#

Add the DMARC record to your DNS:

The record name must be: _dmarc

• For GoDaddy users:

1. Go to DNS management
2. Click “Add”
3. Set Type to “TXT”
4. Set Name to “_dmarc”
5. Paste your DMARC record in Value
6. Click “Save”

• For Cloudflare users:

1. Go to DNS tab
2. Click “Add record”
3. Set Type to “TXT”
4. Set Name to “_dmarc”
5. Paste your record in Content
6. Click “Save”

Step 4 → Monitor your reports#

DMARC reports arrive daily or weekly. They show –

• How many emails passed or failed authentication
• Which IP addresses sent emails from your domain
• Potential security threats

Use tools like DMARCIAN to make these reports easier to read, and our free DMARC checker to confirm the policy receivers actually apply to your domain.

Step 5 → Strengthen your policy gradually#

After monitoring for 2-4 weeks, you can strengthen your policy:

• Quarantine policy: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

This sends suspicious emails to spam folders.

• Reject policy: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

This blocks suspicious emails completely.

Only move to stricter policies after confirming your legitimate emails pass authentication.

Test your complete email authentication setup#

After setting up all three protocols:

1. Use MXToolbox to check each record individually
2. Send test emails to different providers (Gmail, Outlook, Yahoo)
3. Check email headers for authentication passes
4. Monitor your DMARC reports for any failures

Authentication is not a set-and-forget job. Records break when someone edits DNS months later, and a domain can land on a blocklist weeks after a clean setup. Instead of re-running manual lookups every month, SmartReach.io checks all three records for each sending domain and re-checks blacklist status weekly on its own.

1. Open Settings and select Domain health
2. Expand a sending domain
3. Read the DMARC, DKIM and SPF results under Authentication
4. Click Check now after any DNS change

Domain health in SmartReach.io. Per-domain authentication checks, plus blacklist status re-checked weekly.

A domain that fails a check here is the one to fix first. The setup guides linked beside each failed chip point at the exact record that broke.

7 Helpful resources for testing the authentication records#

• MXToolbox.com → Free DNS and email testing
• Mail-tester.com → Complete email deliverability analysis
• Google Postmaster Tools → Monitor your reputation with Gmail
• DMARCIAN → Analyze DMARC reports 
• Google DKIM Set-up Guide
• Micorsoft 365 DKIM set-up Guide
• SmartReach’s free email authentication tools → Check SPF, DKIM and DMARC on any domain, no signup

Avoid these common email authentication mistakes#

Here are some of the most common mistakes people make when setting up SPF, DKIM and DMARC records for email authentication.

#1 Common SPF mistakes:

• Including too many services (SPF has a 10 DNS lookup limit)
• Forgetting to include all email services
• Using the wrong syntax

#2 Common DKIM mistakes:

• Not enabling DKIM signing after adding DNS records
• Using weak 1024-bit keys instead of 2048-bit
• Adding records with incorrect names

#3 Common DMARC mistakes:

• Starting with strict policies instead of monitoring
• Not setting up email to receive reports
• Ignoring the reports once they start arriving

Get pre-configured Gmail & Microsoft 365 inboxes with SmartReach.io#

Now you can avoid the hassle of these technical set-ups by buying custom secondary domains and mailboxes from SmartReach.io directly.

It’s always safer and more effective to send cold emails from custom domains and inboxes built for outreach.

SmartReach.io offers a done-for-you cold email infrastructure, complete with verified domains and inboxes, already configured with SPF, DKIM, and DMARC.

Here’s what you get:

• Pre-warmed Microsoft & Gmail inboxes with high sender reputation
• Secondary domains attached ready for cold email use
• Pre-configured DNS rcords for ready-to-use
• SmartReach cold email platform integration
• Built-in email deliverability protection
• Monthly plans, with no yearly commitments on domains and mailboxes

👉 Try SmartReach.io for FREE. No credit card required.

Final thoughts#

Start with SPF since it’s the easiest to set up. Then add DKIM. Finally, implement DMARC monitoring.

Don’t rush the process. 

Take time to test each step. 

Monitor your email delivery rates as you make changes.

Within a few weeks, you’ll see better inbox placement. 

Your emails will reach more people & campaigns will perform better.

FAQs: SPF, DKIM, and DMARC#