SPF, DKIM and DMARC made simple: a step-by-step guide

If you send email on behalf of your company, you've probably heard of SPF, DKIM and DMARC, usually alongside a screen full of code. The good news: the idea behind all three is simple, and understanding the basics prevents most spam-folder problems.

Think of an envelope. SPF says which post offices may deliver letters with your return address. DKIM is a seal proving the letter came from you and wasn't opened on the way. And DMARC is the instruction you leave at the front desk: "if a letter arrives in my name without a seal and from an unauthorized post office, do this with it".

Why this became mandatory

Scams that use the names of well-known companies are one of the main paths to email fraud. To fight them, the big providers tightened the rules: since February 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC, and Microsoft started requiring the same for Outlook.com in 2025. Without these records, messages tend to go to spam or get rejected outright.

All three are DNS records: configuration lines published in the panel where your domain is managed (Cloudflare, GoDaddy, Namecheap, your hosting provider and others). They don't touch your website or your mailbox.

SPF: who may send on your behalf

SPF is a TXT record published at the root of your domain, listing the servers allowed to send email as @yourcompany.com. For example:

v=spf1 include:_spf.google.com include:spf.example.com ~all

Each include authorizes one service (your company email, your campaign tool, your invoicing system). The final ~all tells providers to be suspicious of any other server.

Most common mistakes:

• Two SPF records on the same domain. There can be only one. With two, providers treat SPF as invalid. Merge the includes into a single record.
• Going over 10 lookups. Each include counts, and so do the includes inside them. Above 10, SPF fails. Remove services you no longer use.
• Forgetting a legitimate service, such as the system that sends invoices, which then starts landing in spam.

DKIM: the digital signature

DKIM signs every email with a secret key held by the sending service. The public key lives in your DNS, under a name like selector._domainkey.yourcompany.com. The receiving provider checks the signature against that key: if it matches, it knows the message came from an authorized service and wasn't altered in transit.

In practice, the sending service sets up DKIM: it shows you the record (a TXT with the key, or a CNAME pointing to it) and you publish it in your DNS. The advantage of a CNAME is that the service can rotate the key regularly without you touching anything.

Note: every service that sends on behalf of your domain needs its own DKIM signature, with its own selector. They coexist without any problem.

DMARC: the house rule

DMARC is a TXT record published at _dmarc.yourcompany.com. It does two things. First, it requires alignment: the domain in the From field must be the same one that passed SPF or signed with DKIM. Second, it says what to do with messages that fail, and where to send reports. A safe starting point:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

The p policy has three levels:

• p=none: monitor only and send reports. Everyone should start here.
• p=quarantine: failing emails go to spam.
• p=reject: failing emails are refused. This is the strongest protection against anyone impersonating your company.

The reports (sent to the rua address) arrive daily from Google, Microsoft, Yahoo and others, and list every server that sent email in your domain's name, legitimate or not. They are what lets you tighten the policy safely.

Step by step

1. List everything that sends on behalf of your domain: company email, campaign tool, ERP, online store, invoicing system, website forms.
2. Publish a single SPF record covering the services on that list.
3. Turn on DKIM in each service and publish the records they show you.
4. Publish DMARC with p=none and an address for reports.
5. Watch the reports for a few weeks and fix anything that fails.
6. Tighten the policy gradually: quarantine and then, once everything passes, reject.

After publishing, DNS can take from a few minutes to a few hours to update. And it's worth checking again every time you switch DNS providers: that's one of the moments when records most often get lost.

How Hermod takes care of it

When you add your domain to Hermod, you see exactly which records to publish, with step-by-step instructions for your DNS provider's panel, and you can send everything straight to whoever manages your website. The DKIM signature uses a CNAME, so Hermod rotates the key for you. DMARC is required, SPF is checked, and provider reports are shown in plain language on the domain health screen. Hermod also checks your DNS every day and warns you if a record disappears. See how it works in Verify your company domain and Domain health, and if your issue is emails landing in spam, read the 12 most common causes.