SPF, DKIM and DMARC — set them up correctly, once

Email authentication is the single highest-leverage deliverability fix available to you. Skipping it costs 30–40 % inbox placement. Setting it up correctly takes twenty minutes. Here are the exact DNS records — copy, adjust your domain, paste, done.

The 3-record stack

Three DNS TXT records work as a layered system. Each one does a distinct job:

DMARC requires at least one of SPF or DKIM to align — meaning the authenticated domain must match the From: domain. Set up all three so you have two alignment paths, not one.

Google Workspace setup

SPF — add this TXT record at your domain root (@):

v=spf1 include:_spf.google.com ~all

If you also send through SparrowiMailer, append before ~all:

v=spf1 include:_spf.google.com include:spf.sparrowimailer.in ~all

DKIM — generate your key in the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email. Copy the TXT record Google gives you and add it exactly as shown (the selector is usually google):

; Host: google._domainkey.yourdomain.com
; Value:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ...
; (your actual key will be much longer — paste it verbatim)

Microsoft 365 setup

SPF:

v=spf1 include:spf.protection.outlook.com ~all

DKIM — go to Microsoft Defender portal → Email & Collaboration → Policies & Rules → DKIM. Enable signing for your domain. Microsoft generates two CNAME records to publish (selectors selector1 and selector2):

; CNAME 1
selector1._domainkey.yourdomain.com → selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

; CNAME 2
selector2._domainkey.yourdomain.com → selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

Zoho Mail setup

SPF:

v=spf1 include:zoho.in ~all
; or for the US data centre:
v=spf1 include:zoho.com ~all

DKIM — Zoho Mail console → Email Authentication → DKIM. Enable it and copy the TXT record provided (selector is typically zoho).

DMARC ramp — 3 stages

Never publish p=reject on day one. Move through three stages, spending at least two weeks per stage while reviewing your DMARC reports:

; Stage 1 — monitor only (2–4 weeks)
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r"

; Stage 2 — quarantine non-aligning mail (2–4 weeks)
_dmarc.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=r; aspf=r"

; Stage 3 — reject non-aligning mail (permanent)
_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s"

The rua address receives aggregate XML reports. You can parse these yourself or use a dashboard tool.

Reading raw DMARC XML files is painful. Use dmarcian.com (free tier available) or Google's Postmaster Tools to visualise your DMARC report data. Within one week of publishing p=none, you'll have a clear picture of every server sending mail in your name — including any you didn't know about.

Testing your setup

After publishing all three records, wait 15–30 minutes for DNS propagation and run these checks:

• MXToolbox SuperTool — verifies SPF, DKIM, DMARC syntax.
• Mail-Tester — send a real email to their disposable address; get a 10-point score showing authentication, content, and blocklist status.
• Gmail header check — send to your own Gmail account, view "Show original", confirm dkim=pass, spf=pass, dmarc=pass.
• SparrowiMailer pre-send check — the dashboard runs all three checks automatically and shows a traffic-light score before you send.

Common mistakes