Email that lands: set up SPF, DKIM and DMARC for your domain

What the big inboxes ask for

• Gmail, every sender: SPF or DKIM, valid forward and reverse DNS for the sending server, TLS, and a spam rate under 0.3% in Postmaster Tools. Google's target is under 0.1%.
• Gmail and Yahoo, 5,000 or more a day: SPF and DKIM, a DMARC record (p=none is enough), a From address that aligns with SPF or DKIM, and one-click unsubscribe on marketing mail.
• Outlook.com, Hotmail and Live, over 5,000 a day: SPF and DKIM must pass, with DMARC at p=none or stricter, since 5 May 2025. Mail that fails goes to Junk or is rejected.

Google counts the 5,000 across every domain under your main domain together, and a sender that crosses it once stays a bulk sender. Your email provider (Postmark, Resend, Amazon SES, Google Workspace, Microsoft 365) handles TLS and reverse DNS. The DNS records are yours.

SPF: one record, every sender in it

SPF is a TXT record on your domain that lists who may send mail for it. It checks the hidden envelope sender (the Return-Path), not the From address people see. A domain has exactly one SPF record: a second one breaks both, and SPF fails for all your mail. When you add a sending service, add its include to the record you have.

v=spf1 include:_spf.google.com include:amazonses.com ~all

SPF stops at 10 DNS lookups. Every include counts, and so do the includes inside it, so a record with six includes can still go over. ~all marks other senders as suspicious and -all fails them; Google's setup guide uses ~all and Microsoft's uses -all.

Transactional providers send with their own Return-Path unless you give them one on your domain. Postmark, for example, asks for a CNAME from pm-bounces to pm.mtasv.net. With it, SPF passes on your domain and lines up with your From address, and you don't add Postmark to your SPF record at all.

DKIM: a key per service

DKIM signs each message with a private key; the public key sits in DNS at selector._domainkey on your domain. Each service you send through signs with its own key, so each gets its own record, under its own selector. Copy the exact values from the provider's dashboard.

• Google Workspace: a TXT record at google._domainkey. Google recommends a 2048-bit key.
• Microsoft 365: two CNAMEs, selector1._domainkey and selector2._domainkey.
• Amazon SES: three CNAMEs, 2048-bit by default.
• Resend: a TXT record at resend._domainkey.

A service that signs with its own domain instead of yours passes DKIM and still fails DMARC, because the signature doesn't match your From address. Set up domain authentication in every service, not only the main one.

DMARC: start at none

DMARC passes when SPF or DKIM passes for a domain that matches the From address. By default the match is relaxed: mail.example.com counts for example.com. The record sits at _dmarc on your domain and names a policy and an address for daily reports.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

1. Publish p=none and read the reports. Every service sending as your domain shows up there, including the ones you forgot.
2. Fix each one until it passes, usually with its DKIM records or a custom Return-Path.
3. Move to p=quarantine. RFC 9989, the current DMARC standard, suggests at least a month at none and a similar period at quarantine.
4. Move to p=reject only when the reports stay clean, and not if your people post to mailing lists, which RFC 9989 warns against.

Check it worked

dig TXT example.com +short
dig TXT _dmarc.example.com +short
dig TXT google._domainkey.example.com +short

Then send a message to a Gmail address, open it, choose More and Show original, and read the Authentication-Results header. You want spf=pass, dkim=pass with your domain after d=, and dmarc=pass.