Updated 31 October 2026
Set up SPF and DKIM first. Then publish a DMARC record with p=none, read the reports, fix what fails, and only then move to quarantine and reject.
The three records
| Record | What it says |
|---|---|
| SPF | Which servers may send mail for your domain |
| DKIM | A signature that shows a message really came from you |
| DMARC | What receivers should do when those checks fail, and where to send reports |
Step by step
- List everything that sends mailYour mailboxes, but also your website, booking system, newsletter tool and invoicing software. This is the step people skip.
- Publish one SPF recordOne per domain. Stay within SPF's limit of 10 DNS lookups, which is easy to exceed with many tools.
- Switch on DKIMDo this in your mail provider, and for each outside tool that sends for you.
- Publish DMARC with p=noneThis changes nothing for delivery, and the reports start coming in.
- Read the reportsA DMARC tool makes these readable. Find your real senders that fail, and fix them.
- Move to quarantineFailing mail goes to spam. Watch for problems.
- Move to rejectFailing mail is refused. This is the setting that really protects your domain.
The records for your mail provider
Microsoft 365
TXT @ v=spf1 include:spf.protection.outlook.com -allFor DKIM, Microsoft gives you two CNAME records, for selector1 and selector2. Publish both, copy them exactly from the admin portal, then enable signing there. Some DNS panels add your domain to the name automatically, so check for a doubled hostname.
Google Workspace
TXT @ v=spf1 include:_spf.google.com ~allGenerate the DKIM key in the Google Admin console, publish it as a TXT record, then start authentication there.
Mailbox from your hosting provider
Ask your provider for the exact SPF include and for how DKIM works on their platform. Don't guess the value.
DMARC, for every provider
TXT _dmarc v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comReplace the address with a mailbox you actually read. Later, you change p=none to p=quarantine and then to p=reject.
These are common examples. If your provider shows different values, use theirs. Your full SPF record has to include everything that sends for you, so don't just paste one of these over an existing record.
How to check it worked
Send a mail to an outside address and open the message headers. You want to see pass for SPF, DKIM and DMARC. Bear in mind that a DNS record alone doesn't demonstrate effective protection, so keep reading your reports.
Questions about DMARC
What does a DMARC policy of none mean?
It means receivers only report on mail that fails the checks. Nothing is blocked. It's the right place to start, but it doesn't stop anyone from spoofing your domain.
How long should we stay on p=none?
Until the reports show that all your real mail passes. That can be a few weeks, or longer if many systems send on your behalf. There's no fixed number.
Do we need DMARC if we only have a few mailboxes?
Yes, if your domain sends mail, because the risk is someone else sending in your name. Google and Yahoo also ask bulk senders for DMARC, and other receivers look at it too.
