How do I set up SPF, DKIM and DMARC for my email marketing platform?

You’ll add a few DNS records for a domain you control, then verify them in your email platform. The platform should give you the exact values—use those rather than copying example SPF or DKIM values from elsewhere, since they differ by provider.

1. Choose your sending domain

Use an address such as news@yourdomain.com and authenticate yourdomain.com (or a dedicated subdomain such as mail.yourdomain.com). Keep the domain in the visible From address aligned with either your SPF or DKIM domain; that’s how the message can pass DMARC alignment. (support.google.com)

2. Get the records from your platform

In your marketing platform, look for Domain authentication, Sending domains, or Email authentication. It will typically provide:

• SPF: the platform’s required include or sending-domain setting.
• DKIM: one or more TXT or CNAME records, often with a selector such as selector._domainkey.
• Sometimes a custom return-path or tracking-domain record as well.

3. Publish them in your DNS

Sign in where your domain’s DNS is managed, and add the records exactly as the platform specifies. DNS record “Host” fields vary by provider: some expect only the subdomain (like selector._domainkey), while others expect the full name.

SPF: If your domain already has an SPF TXT record, edit it to include the marketing platform—don’t add a second SPF record. SPF has a limit of 10 DNS lookups, so avoid piling on includes. (help.activecampaign.com)

DKIM: Publish each selector record the platform supplies. Don’t substitute a generic DKIM key; the platform needs to sign messages with the matching private key.

DMARC: Add a TXT record at _dmarc.yourdomain.com. A cautious monitoring starting point is:

Host:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Use a mailbox or reporting service that can receive DMARC reports. p=none requests reports without asking receivers to quarantine or reject failures. After you’ve reviewed reports and confirmed legitimate senders pass, you can move gradually to p=quarantine and eventually p=reject. Don’t enforce a strict policy before identifying all services that send mail for your domain. Gmail and Yahoo require bulk senders to publish DMARC, with at least p=none; Gmail also requires alignment for direct mail. (support.google.com)

4. Verify and test

Return to the platform and click Verify, Authenticate, or Check DNS. DNS changes may take time to appear. Send a test message to an inbox you can inspect and check its original headers for:

• SPF: PASS
• DKIM: PASS
• DMARC: PASS

For DMARC, passing SPF or DKIM alone isn’t enough if the authenticated domain doesn’t align with the visible From domain. (support.google.com)

Common pitfalls: a second SPF record, a typo in the DKIM host/value, publishing records in the wrong DNS account, or turning on DMARC enforcement before all legitimate senders are authenticated. Also remember that email authentication is only one part of deliverability; Gmail and Yahoo have additional bulk-sender requirements, including easy unsubscribe for marketing messages. (support.google.com)

If you tell me which email marketing platform and DNS provider you use, I can translate its specific records into the right DNS entries.

Your marketing platform sends mail as your domain, so each platform needs its own authentication records. Here's the general process. Your platform's dashboard will give you the exact values.

1. List every sender. Include your marketing platform, your help desk, billing, CRM, and any transactional tools. Start by listing every service that sends email using your domain.

2. Publish one SPF record. SPF is a single TXT record on your domain root (@). Add an include: entry for each sender, and don't create a second SPF record. For example: v=spf1 include:_spf.google.com include:[your-marketing-platform's-include] ~all. Note that SPF allows 10 DNS lookups in total, and every include: counts, including the ones nested inside it. If you go over, SPF fails, so remove services you no longer use before adding new ones.

3. Enable DKIM in the marketing platform. Find the sending domain or DKIM settings in the platform, generate the key, and publish the CNAME or TXT records it gives you at the selector hostname. Then return to the platform and turn on signing. Use 2048‑bit keys when supported. Repeat this for each platform, since each ESP gets its own selector — they don't conflict.

4. Publish DMARC in monitor mode. Create a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
The rua address receives aggregate reports, which show who is sending as your domain. p=none protects nothing on its own; it produces reports, and only if the record has a rua address.

5. Verify. Send a test campaign and check the message headers for SPF, DKIM, and DMARC results. Each message should show PASS for SPF, DKIM, and DMARC. Make sure the DKIM d= domain matches your From domain, since DMARC requires alignment.

6. Tighten the policy gradually. Once reports show every legitimate sender passing, move to p=quarantine, then p=reject. Guidance on timing varies. Some sources suggest about 90 days at p=none, and others say Organizations should start at p=none to discover all legitimate senders, fix authentication failures, then progress through quarantine to reject over 9 to 18 months. A reasonable approach is to watch reports for at least a full monthly cycle, then tighten. Sources also disagree on the ramp mechanism. Older guides use pct= to phase in enforcement, while one newer guide says why pct no longer stages a rollout and what replaced it, which it describes as the t=y tag. Check the current spec before relying on either.

Common pitfalls

• Forgetting the marketing platform in SPF. Relying only on DKIM still works, but SPF helps if DKIM breaks.
• Going straight to reject. A legitimate sender you missed gets blocked. The legitimate sender's email will be rejected - the recipient will not receive it.
• Using a dedicated subdomain (for example, mail.yourdomain.com) for marketing sends. This isolates marketing reputation and makes enforcement easier to manage. Set up SPF, DKIM, and DMARC for that subdomain too.
• Note on p=reject for general-purpose domains: one recent source says RFC 9989 says general-purpose email domains should not publish p=reject because indirect flows can break authentication even when the original message was legitimate. If your main domain handles employee mail and forwarding, you may want to stop at quarantine.

If you tell me which platform you use (for example, Mailchimp, HubSpot, Klaviyo, or SendGrid) and your DNS provider, I can give you the specific record names and steps.

Setting up SPF, DKIM, and DMARC is essential for modern email marketing, as major providers like Google and Yahoo now require these authentications to ensure your messages reach the inbox rather than the spam folder.

Follow this sequence to ensure your setup is secure and effective.

The Recommended Setup Order

Always set them up in this order: SPF → DKIM → DMARC.
If you jump straight to DMARC (specifically with a "reject" policy) before your other records are working, you risk blocking your own legitimate emails.

Step 1: Set Up SPF (Sender Policy Framework)

SPF tells receiving servers which IP addresses or services (like your email marketing platform) are authorized to send email on your behalf.

• Action: Log in to your DNS provider (e.g., GoDaddy, Cloudflare, Namecheap).
• Create a TXT Record: You can only have one SPF record per domain.
• Configuration: If you already have an SPF record for your workspace (e.g., Google Workspace), do not create a new one. Instead, edit the existing one to include your marketing platform.
  • Example format: v=spf1 include:_spf.google.com include:marketingplatform.com ~all
• Important: Use ~all (soft fail) while testing, which tells receivers to be cautious but not necessarily reject mail if the source isn't listed.

Step 2: Set Up DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your emails, proving they were not tampered with during transit.

• Action: Go to your email marketing platform’s settings (often found under "Domains," "Sender Authentication," or "Deliverability").
• Generate Keys: The platform will provide you with specific values for a new DNS TXT record.
• Publish: Copy these values into your DNS provider's settings. These records usually look like selector._domainkey.yourdomain.com.

Step 3: Set Up DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and provides instructions to receiving servers on what to do if an email fails authentication.

• Action: Create a single TXT record in your DNS under the host name _dmarc.
• Policy: Start with a "none" policy to monitor your traffic without blocking any emails.
  • Example value: v=DMARC1; p=none; rua=mailto:your-email@yourdomain.com
• Monitor: The rua tag sends aggregate reports to your email address so you can see if your legitimate emails are passing authentication. Once you see that all your email is passing, you can eventually change p=none to p=quarantine or p=reject to tighten security.

Pro Tips for Success

• Don't Rush the "Reject" Policy: Only change your DMARC policy from p=none to p=reject after you have analyzed your reports and are 100% sure all your legitimate email services are properly authenticated.
• Use Your Platform’s Tools: Most modern email marketing platforms have a "Domain Authentication" or "Setup Wizard" that will provide the exact DNS records you need to copy and paste. Start there, as it minimizes human error.
• Check Propagation: DNS changes can take anywhere from a few minutes to 48 hours to propagate globally. Use online DNS lookup tools to verify that your new records are visible.

Here’s a safe, provider-neutral setup. Use your marketing platform’s exact DNS instructions where they differ—the record values are specific to your account.

1. Choose a sending domain

Use a domain you control in the visible From address. A dedicated subdomain such as news.example.com can keep marketing mail separate from regular business email. Configure authentication for the domain or subdomain you actually send from; a root-domain SPF record does not automatically cover subdomains. ¹²

2. Configure SPF

In your DNS host, add or update the SPF TXT record with the sending sources your platform specifies. SPF records start with v=spf1; for example, a platform might ask you to add an include: mechanism.

• Keep one SPF record per domain. If you already have one, merge the platform’s entry into it—don’t publish a second SPF record.
• Include every legitimate sender for that domain, not just the marketing platform.
• Don’t copy a sample include: value without confirming it with your provider. ²⁵

3. Configure DKIM

In your platform’s domain-authentication settings, generate or retrieve its DKIM DNS records—often one or more CNAME records, sometimes TXT records. Add them exactly as shown, including the host/name and target/value, then enable DKIM signing in the platform after it verifies the records.

Prefer signing with your own domain, and make sure the DKIM signing domain aligns with the visible From domain. ¹⁴¹¹

4. Publish DMARC in monitoring mode

Once SPF and DKIM are working, add a TXT record named _dmarc at the domain you want to protect. A typical monitoring starter is:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Replace the reporting address with a mailbox you control. DMARC passes when at least one of SPF or DKIM both passes and aligns with the visible From domain; configuring both to align is recommended. ⁵¹¹

5. Verify, monitor, then strengthen

Send test messages and inspect their authentication results or message headers for SPF=pass, DKIM=pass, and DMARC=pass. Check DMARC reports for all legitimate senders and fix any failures before changing policy. Start with p=none; after confirming legitimate mail is covered, consider moving gradually to p=quarantine, then p=reject. ¹¹¹⁵

Important: Don’t invent or remove existing DNS records without checking what they support. Incorrect SPF, DKIM, or DMARC changes can affect other email services using your domain. For Gmail recipients, bulk senders are expected to have SPF, DKIM, and DMARC configured; at least SPF or DKIM must align with the From domain to pass DMARC. ⁵¹²

Sources

¹ Microsoft, Troubleshoot email authentication
² Microsoft, Set up SPF
⁴ Microsoft, Set up DMARC
⁵ Google, Email sender guidelines
¹¹ Google Workspace, Set up DMARC
¹² Google, Email sender guidelines FAQ
¹⁵ DMARC.org, Overview