How to Setup SPF, DKIM, and DMARC for Email Security

If you’ve ever wondered why your emails sometimes end up in the spam folder or worse, if someone could send emails pretending to be you, you're not alone. Email security has become more important than ever, especially with phishing attacks and domain spoofing on the rise. Fortunately, the email system itself comes with built-in tools to help protect your domain and enhance your email deliverability.

In this guide, we’ll walk you through setting up SPF, DKIM, and DMARC, three essential email authentication protocols that work together to keep your emails safe and trusted. Whether you’re managing email for a business, a non-profit, or your personal domain, these steps will help ensure your messages land where they’re supposed to: in the inbox.

What are DMARC, DKIM, and SPF?

DMARC, DKIM, and SPF are three key email authentication protocols that work together to protect domains from unauthorized use, such as email spoofing, phishing, and spam.

SPF and DKIM serve as official credentials, similar to a business license or a medical degree, displayed in an office, which helps verify that an email is genuinely sent from the claimed domain.

DMARC, on the other hand, instructs receiving mail servers on how to handle emails that fail SPF or DKIM checks. It can tell the server to deliver the message, flag it as spam, or reject it entirely.

If a domain hasn’t properly configured SPF, DKIM, and DMARC, its emails may be marked as spam or rejected outright. Worse still, the domain may be exploited by attackers to send fraudulent messages that appear to originate from a trusted source.

How does SPF work?

The Sender Policy Framework (SPF) allows a domain to specify which mail servers are authorized to send emails on its behalf. It’s similar to a public employee directory that helps verify whether someone is part of an organization.

An SPF record contains a list of approved IP addresses that are permitted to send emails on behalf of the domain. When a receiving mail server gets a message, it checks the email’s source against the domain’s SPF record. If the server sending the email isn’t listed, the message may be flagged or rejected before reaching the recipient’s inbox.

How does DKIM work?

DomainKeys Identified Mail (DKIM) allows domain owners to add a digital signature to their emails, much like signing a check to prove its authenticity. This digital signature employs cryptographic techniques to verify that the email originated from the claimed domain and hasn’t been tampered with during transit.

DKIM relies on public key cryptography:

• The domain publishes a DKIM record containing a public key, which receiving mail servers can use to verify the authenticity of emails.
  
  
• The private key is securely held by the sender’s system and is used to create a digital signature on the email’s header.
  
  
• When the email is received, the recipient’s mail server uses the public key to verify that the signature matches, confirming that the domain’s private key indeed signed the message and has not been altered.

How does DMARC work?

Domain-based Message Authentication, Reporting & Conformance (DMARC) helps email-receiving servers decide what to do when an email fails SPF and/or DKIM checks. A domain’s DMARC policy can tell mail servers to:

• Deliver the email anyway
  
  
• Mark it as spam (quarantine)
  
  
• Reject it entirely
  
  

These instructions are defined in a DMARC record, which also allows domain owners to request reports from receiving mail servers. These reports indicate which messages passed or failed SPF and DKIM checks, enabling administrators to monitor potential abuse or refine their policies (for example, if legitimate emails are being incorrectly blocked).

Where are SPF, DKIM, and DMARC records stored?

SPF, DKIM, and DMARC records are stored in the Domain Name System (DNS), the same system that translates website names into IP addresses, so browsers can load websites.

Specifically, these email authentication records are stored as DNS TXT records, which are used to associate custom text with a domain. While DNS TXT records can serve many purposes, SPF, DKIM, and DMARC are three of the most common email-related uses.

The DNS can also store other types of records, such as:

• CNAME – for aliasing domain names
  
  
• AAAA – for IPv6 addresses
  
  
• PTR – for reverse DNS lookups

1. Set Up SPF (Sender Policy Framework)

SPF helps prevent spoofing by specifying which mail servers are allowed to send emails for your domain. Access your domain DNS settings from your domain registrar or DNS host.

• Create a TXT record with the following format:
  
  Type: TXT

        Name: @ (or your domain)

       Value: v=spf1 include:your-email-provider.com ~all

       TTL: 3600 (or default)

Example:

If you're using Google Workspace:

v=spf1 include:_spf.google.com ~all

Explanation:

• v=spf1: Version
  
  
• include: Authorizes other domains to send on your behalf
  
  
• ~all: Soft fail (change to -all for strict fail)
  
  

2. Set Up DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails, allowing recipients to verify that the email really came from your domain.

Steps:

1. Go to your email provider’s admin panel
   
   
2. Generate DKIM keys (public & private)
   
   

• Most email providers (like Google Workspace, Microsoft 365, etc.) have this built in.
  
  

Add a TXT record in your DNS:

Type: TXT

Name: default._domainkey.yourdomain.com

Value: v=DKIM1; k=rsa; p=YourPublicKeyHere

TTL: 3600

1. Enable DKIM signing in your provider’s settings
   
   

Example:

Google might give you something like:

• Name: google._domainkey
  
  
• Value: v=DKIM1; k=rsa; p=MIGfMA0GCSq...
  
  

3. DMARC (Domain-based Message Authentication, Reporting & Conformance)

Purpose: Tells receiving mail servers how to handle unauthenticated emails (that fail SPF and DKIM checks).

How to Set Up DMARC:

Create a DMARC Record as a TXT Record

Name: _dmarc.yourdomain.com

Type: TXT

Value: v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100

1. v=DMARC1 – DMARC version.
   
   

• p=quarantine – Policy for failed emails (options: none, quarantine, reject).
  
  
• rua=mailto:... – Address to send aggregate reports.
  
  
• pct=100 – Apply to 100% of emails.
  
  

• p=none – Just monitor, don’t take action.
  
  
• p=quarantine – Send failed messages to spam/junk.
  
  
• p=reject – Block failed messages outright.
  
  

• Postmark DMARC
  
  
• DMARC Analyzer
  
  
• Valimail
  
  

• Use services like:
  
  

Conclusion

Setting up SPF, DKIM, and DMARC might seem a bit technical at first, but taking the time to get them right is one of the best things you can do to protect your domain and improve your email deliverability. These protocols work together to verify that your emails are coming from a trusted source and to prevent others from misusing your domain for spam or phishing attacks.

Once everything is in place, you’ll not only gain more control over your email reputation, but your messages will also be far more likely to reach inboxes instead of spam folders. Email security isn't just for big companies, it's essential for anyone who wants to communicate safely and professionally online.