SPF/DKIM/DMARC Setup Guide: Configure All Three Records
All three authentication records published, validated, and passing. DMARC in monitor mode. Confirmation from a test tool before the first send.
Before You Start
Setup takes 30-60 min: what you need before step 1
Output: SPF, DKIM, and DMARC published in DNS, all three passing in a test send, DMARC at p=none to collect reports before enforcing any policy.
Time: 30-60 minutes per domain for initial setup. Allow 24-48 hours for DNS propagation before running validation tests. Each additional domain takes 15-20 minutes once you know the pattern.
DNS management access for the sending domain. Your ESP's DKIM selector name and public key (found in its domain authentication settings). A monitored mailbox to receive DMARC aggregate reports. A test tool: Mail-Tester (free, 3 tests/day) or GlockApps for ongoing monitoring.
Workflow Overview
5-step authentication setup at a glance
| Step | Action | DNS record type | Output |
|---|---|---|---|
| 1 | Publish the SPF record | TXT on root domain | Receiving servers know which IPs are authorized to send from your domain |
| 2 | Generate and publish the DKIM key | TXT on selector subdomain | Outbound emails carry a cryptographic signature the receiving server can verify |
| 3 | Publish the DMARC record (p=none) | TXT on _dmarc subdomain | Receiving servers send aggregate reports; no mail is blocked yet |
| 4 | Validate all three records pass | Test via Mail-Tester or GlockApps | Confirmation that SPF, DKIM, and DMARC are all returning pass results |
| 5 | Graduate DMARC policy after monitoring | Update existing TXT record | Policy moves to p=quarantine after clean reports; p=reject when fully stable |
DMARC at p=reject before reviewing reports will block legitimate mail from authorized senders not yet in your SPF record. Always start at p=none and graduate after at least two weeks of clean reports.
Step by Step
All 5 steps: from DNS access to validated authentication
- Publish the SPF record as a TXT entry on your root domain
Create a TXT record at the root (@) with the value: v=spf1 include:[your-ESP] ~all (Google Workspace: include:_spf.google.com; Microsoft 365: include:spf.protection.outlook.com; other ESPs list their include value in their domain authentication docs). One domain, one SPF record: add new includes to the existing one, never create a second.
- Generate the DKIM key in your ESP and publish it in DNS
In your ESP's domain authentication settings, copy the DKIM selector name and public key, then create a TXT record at [selector]._domainkey.[yourdomain] with the public key as the value. Multiple ESPs each get their own selector subdomain with no conflict.
- Publish the DMARC record at _dmarc.[yourdomain], start at p=none
Create a TXT record at _dmarc.[yourdomain] with the value: v=DMARC1; p=none; rua=mailto:[your-report-address], using a monitored mailbox for the rua address. Do not set p=quarantine or p=reject at this stage.
DNS propagation is not instant. A DKIM test run immediately after publishing often shows a failure that resolves within hours. Test the following day to avoid false failures and unnecessary republishing.
- Validate all three records pass before sending any campaigns
Send a test email from the configured mailbox to Mail-Tester (mail-tester.com, free, 3 tests/day) and confirm SPF shows pass, DKIM shows a valid signature, and DMARC is present. Do not begin any outbound campaigns until all three return a passing result.
- Graduate the DMARC policy to p=quarantine after 2-4 weeks of clean reports
Review DMARC aggregate reports at your rua address and confirm all legitimate sending sources are passing. Edit the DMARC TXT record to change p=none to p=quarantine, then wait 4+ weeks before considering p=reject.
Authentication records break silently after DNS changes. GlockApps uptime monitoring watches SPF, DKIM, and DMARC records and sends alerts the moment any fail, from $59/month.
Common Failures
4 failures that break authentication after setup
SPF over-lookup failures and duplicate SPF records are the two most frequent errors. Both are invisible until inbox placement drops or a validation tool flags the DNS configuration.
Common Questions
SPF/DKIM/DMARC setup: 5 frequently asked questions
Five items: SPF TXT published with no duplicate, DKIM TXT at the correct selector subdomain, DMARC at _dmarc.[domain] with p=none and a valid rua address, all three passing in a Mail-Tester test send. Add a monitoring tool (GlockApps) to alert on future record failures.
For SPF: Google Workspace uses include:_spf.google.com, Microsoft 365 uses include:spf.protection.outlook.com, and other ESPs list their include value in their domain authentication docs. For DKIM, copy your ESP's selector and key from its settings panel; DMARC syntax is universal: v=DMARC1; p=none; rua=mailto:[your-address].
Not directly: DMARC at p=none protects your domain reputation by blocking spoofing, and Google requires a DMARC record for domains sending over 5,000 emails/day to Gmail. All three records correctly configured are a deliverability baseline, not a placement fix.
Revalidate after any DNS change, ESP migration, new sending tool, or nameserver transfer. Outside these events, GlockApps uptime monitoring handles ongoing validation automatically without manual work.
Use ~all (softfail) during initial setup and whenever any sending source may be missing from your SPF record. Graduate to -all (hardfail) only once DMARC reports confirm every legitimate sender is captured.
Records configured. Now monitor them automatically.
GlockApps monitors SPF, DKIM, and DMARC record uptime continuously and sends alerts the moment any authentication record breaks after a DNS change.