How to set up DMARC in one day: SPF, DKIM and DMARC

To set up DMARC, you publish three short text records in your domain's DNS: SPF says which services may send email as your domain, DKIM adds a signature to each message, and DMARC tells other mail servers what to do when a message fails those checks. You can put all three in place in one working day. Full protection comes a few weeks later, once reports show your real mail passes.

What SPF, DKIM and DMARC each do

DNS (Domain Name System) is the public directory for your domain. It can hold short notes called TXT records, and all three settings are TXT records (DKIM is sometimes a CNAME, a pointer to a record your provider keeps). You add them in the panel where you manage your domain, usually at the company where you bought it.

• SPF (Sender Policy Framework) is a guest list. It names the servers allowed to send mail for your domain.
• DKIM (DomainKeys Identified Mail) is a signature. Your email service signs each message with a secret key, and the matching public key sits in your DNS so anyone can check it. A forged or altered message fails the check.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) is the rule. It says what to do with mail that uses your domain but fails: nothing (none), send it to spam (quarantine) or refuse it (reject). It also asks receivers to send you reports.

Alignment, in plain words

Every email has two sender addresses: the From line people see, and a hidden return address used for bounces. SPF only checks the hidden one, so a scammer could pass SPF with their own domain while showing yours in the From line. DMARC closes that gap with alignment: SPF or DKIM only counts if the domain it checked matches the visible From domain. One aligned pass is enough, and in the usual relaxed mode a subdomain such as news.example.com matches example.com.

Record	Name in DNS	Example value for example.com
SPF	example.com	v=spf1 include:_spf.mailhost.example include:spf.invoice-app.example ~all
DKIM	selector1._domainkey.example.com	v=DKIM1; k=rsa; p=MIIBIjANBgkqh... (a long key your service gives you)
DMARC	_dmarc.example.com	v=DMARC1; p=none; rua=mailto:dmarc@example.com

The include: values are placeholders; each service gives you its own.

Why it matters now

Since February 2024, Gmail and Yahoo ask every sender to use at least SPF or DKIM. Bulk senders must have both, plus a DMARC record of at least p=none that aligns, and one-click unsubscribe on marketing mail. Gmail counts you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts in one day, and that status does not expire. In 2025 Microsoft announced similar rules for Outlook.com, Hotmail and Live addresses. Since 5 May 2025, domains that send more than 5,000 messages a day to them must pass SPF, DKIM and DMARC, or their mail is rejected.

A small business may never send 5,000 emails a day. It still matters. Without DMARC, anyone can send email with your domain in the From line, which is how fake invoices and "we changed our bank account" messages reach your clients. Unauthenticated mail is also more likely to land in spam.

The one-day plan

Morning: list everything that sends as your domain

1. Check where you stand. Type your domain into the Email security checker. It shows your SPF, DKIM and DMARC in green, amber or red. The lookups go from your browser to Cloudflare's public DNS resolver, and eThorns stores nothing.
2. Write down every service that sends email with an address at your domain: your mailbox provider, invoicing software, newsletter tool, website contact forms and online store, plus things like a booking system or the office scanner.
3. To find forgotten ones, search your mail for automatic messages from your domain and check the software you pay for each month.

Midday: fix SPF and turn on DKIM

1. Open DNS lookup, type your domain and pick TXT. Find every line that starts with v=spf1. There must be exactly one.
2. Build a single SPF record. Put every service's include: value (from its help page) in one line and end it with ~all, which means "treat anyone else as suspicious".
3. Stay under 10 lookups. Each include, a, mx, exists or redirect costs one DNS lookup, and so do the includes inside each provider's record. More than 10 makes SPF fail. The Email security checker follows every include down the chain and shows the total, so you see the number that counts. If you are close, remove services you no longer use.
4. Turn on DKIM in each service. In its settings, look for "authenticate your domain", "DKIM" or "sender domain". It gives you one or more records to add to your DNS, then a button to verify. Write down the selector: the part before ._domainkey.
5. Wait for the changes. New records can take minutes to a few hours to show everywhere. The DNS propagation checker asks 10 public resolvers at once. It sends the name and record type to the eThorns server, which keeps only the result for one minute.

Afternoon: publish DMARC with p=none

1. Create an address for reports, for example dmarc@example.com.
2. Add a TXT record with the name _dmarc and the value v=DMARC1; p=none; rua=mailto:dmarc@example.com. The rua tag says where reports go.
3. Run the Email security checker again. SPF should be green and DKIM found. DMARC will be amber at p=none: expected, since it only monitors. If DKIM shows as not found, type your selector in the optional field.
4. Send a test message to a personal Gmail account and choose "Show original". SPF, DKIM and DMARC should all say PASS.

The following weeks: from none to reject

1. Read the reports. Large providers usually send one a day, as a zipped XML file. A DMARC report service can turn them into a readable table. Look for sources that send as your domain and fail. It is either a service you forgot (fix its SPF or DKIM) or someone pretending to be you.
2. When all your real mail passes for a couple of weeks, change the record to p=quarantine. Failing messages now go to spam.
3. After a few more quiet weeks, change it to p=reject. Failing messages are now refused.
4. Keep the rua address. Whenever you add a new tool that sends email, set up its DKIM before it sends anything.

Common mistakes

• Two SPF records. Adding a second v=spf1 line for a new service breaks SPF for all your mail. Merge them into one.
• Using +all. It means "anyone on the internet may send as me". That is worse than having no record. Use ~all or -all.
• Going straight to p=reject. The invoicing tool you forgot gets blocked, and you find out when a client says the invoice never arrived.
• The DMARC record in the wrong place. It lives at _dmarc. Many DNS panels add your domain automatically, so typing the full _dmarc.example.com can create _dmarc.example.com.example.com.

Checklist

• A list of every service that sends as your domain.
• One SPF record, ending in ~all or -all, under 10 lookups.
• DKIM turned on and verified in each service.
• A DMARC record at _dmarc with p=none and a rua address.
• A test message showing SPF, DKIM and DMARC PASS.
• A date in your calendar to review reports and move to quarantine, then reject.

Frequently asked questions

Do I need DMARC if I only send a few emails a day?

Yes. The strict Gmail, Yahoo and Microsoft rules target bulk senders, but DMARC is what stops strangers sending mail as your domain, whatever your volume.

Will DMARC stop every fake email that uses my company's name?

No. It protects your exact domain. It does not stop lookalike domains such as examp1e.com, or free email accounts that only use your company name as the display name. You can check for lookalikes with the lookalike domain checker.

What is the difference between ~all and -all?

~all marks unlisted senders as suspicious; -all fails them. Once DMARC is at quarantine or reject, receivers follow the DMARC policy, so ~all is a common and safe choice.

How long does it take to reach p=reject?

For a small business, often a few weeks to a couple of months. It depends on how quickly the reports show that every real sender passes.

Try it

• 2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
• 2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
• 2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.