SPF, DKIM and DMARC, set up step by step.

The safe order, in one paragraph

Publish SPF and turn on DKIM first. Wait about 48 hours, which is what Google recommends before adding DMARC. Then publish DMARC at p=none with an address for reports, watch the reports for a week or two, and tighten to p=quarantine and then p=reject once only your real senders show up. Gmail already requires every sender to use SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts to use all three. New to these records? Start with SPF, DKIM and DMARC explained.

Before you touch DNS

• Find where your DNS lives. It's wherever your domain's nameservers point, often GoDaddy, Cloudflare or your web designer's account. The records go there, not in your email account.
• List everything that sends email as you: your mailbox provider, website forms, invoicing, booking, payroll and newsletter tools. Each one needs to pass SPF or, better, sign with DKIM as your domain.
• Keep one SPF record. Two SPF records on the same domain make SPF fail for all of them. Add every sender to a single record instead.
• Stay under 10 lookups. Each include: costs at least one DNS lookup, and SPF fails with a permanent error past 10.

Google Workspace

• SPF: add a TXT record at @ with the value v=spf1 include:_spf.google.com ~all. Google recommends ~all.
• DKIM: in the Admin console, go to Apps, Google Workspace, Gmail, Authenticate email. Pick your domain and click Generate new record, choosing a 2048-bit key if your DNS host supports it. Add the TXT record it shows (its name is google._domainkey) at your DNS host.
• Turn it on: back on the Authenticate email page, click Start authentication. Google says DKIM can take up to 48 hours to start working, and if you only just set up Gmail, the key may not be available for 24–72 hours.

Microsoft 365

• SPF: add a TXT record at @ with the value v=spf1 include:spf.protection.outlook.com -all. Microsoft recommends -all for Microsoft 365 domains, alongside DKIM and DMARC.
• DKIM: until you turn it on, Microsoft 365 doesn't sign your mail with your own domain. In the Defender portal (security.microsoft.com), go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, and open the DKIM tab. Select your domain. If no CNAME values show yet, try switching DKIM on once: the portal then lists the two records to publish, selector1._domainkey and selector2._domainkey.
• Add both CNAME records exactly as shown. The values are unique to your account, so copy them rather than typing them from an example.
• Turn it on: once Microsoft detects the records, which can take a few minutes or longer, switch on "Sign messages for this domain with DKIM signatures".

GoDaddy

To add any of these records at GoDaddy: open your Domain Portfolio, select the domain, open the DNS tab and choose Add New Record. Pick the type (TXT or CNAME), enter the name (@ for your main domain, _dmarc for DMARC, or the DKIM name your provider gives you) and the value, then save. GoDaddy says most changes take effect within an hour and can take up to 48 hours.

Using GoDaddy's Professional Email? Its SPF record is v=spf1 include:secureserver.net -all, and GoDaddy may have added it already if your domain, DNS and email are in the same account. DKIM is two CNAME records, secureserver1._domainkey and secureserver2._domainkey, with values from your Email & Office dashboard. Add both before DMARC.

Your other senders

For each tool on your list, search its settings or help pages for "domain authentication" or "DKIM". Many give you records to add so they sign mail as your domain. Without that, as Microsoft points out, mail a service sends for you can pass SPF for its own domain and still fail DMARC for yours. If the tool also asks for an SPF include:, add it to your one SPF record.

Own a domain you never send email from? Protect it too, with SPF v=spf1 -all and DMARC v=DMARC1; p=reject;, so nobody can send mail that appears to come from it.

Publish DMARC, then tighten it

• Start: add a TXT record named _dmarc with v=DMARC1; p=none; rua=mailto:[email protected], after creating that mailbox. Use a dedicated mailbox or group, not someone's inbox: reports arrive as daily XML files.
• Watch: read the reports for a week or two. Every legitimate sender should pass using your domain, not just its own.
• Tighten: move to p=quarantine, then p=reject. Google and Microsoft both describe an optional pct= tag if you'd like to apply the policy to a share of failing mail first.
• Keep alignment relaxed unless you know you need strict. Strict settings (aspf=s or adkim=s) can fail mail from subdomains that would otherwise pass.

Check your work

• Send a message to a Gmail address, open it, choose Show original from the three-dot menu, and look for SPF, DKIM and DMARC all marked PASS.
• Run our free email and website check, which reads your SPF and DMARC records from public DNS.
• In your first DMARC reports, look for any sender you recognize that's failing, and fix it before you tighten the policy.

Common mistakes

• Two SPF records instead of one.
• Jumping straight to p=reject and blocking your own invoices.
• Forgetting the website form or booking tool that also sends as you.
• Typing your full domain into a Name field that adds it for you, so the record lands at the wrong name with your domain in it twice.
• Small typos: Microsoft lists a trailing period and include= instead of include: among the common SPF errors.

Want it done for you?

Our Email & Website Security Audit is $499, one time. We go through your email authentication (DMARC, SPF and DKIM), your website's basic security headers and anything else exposed in public records, then send a short plain-English report with exactly what to fix — and we handle the quick wins. For DNS changes we give you the exact record to paste, or do it for you if you give us access. Get the audit, or start with the free check.

Quick answers

In what order should I set up SPF, DKIM and DMARC? SPF and DKIM first. Google recommends waiting 48 hours before adding DMARC. Start DMARC at p=none with a report address, then move to quarantine and reject once the reports show only your real senders.

Can a domain have two SPF records? No. Two SPF records on the same domain make SPF fail with a permanent error. Combine every sender into one record, and keep it under 10 DNS lookups.

Should my SPF record end in ~all or -all? Follow your provider: Google recommends ~all for Google Workspace, and Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC. Either way, set up DKIM and DMARC too: DMARC is what tells receivers how to treat mail that fails.

How long do SPF, DKIM and DMARC changes take to work? Most DNS changes take effect within an hour but can take up to 48 hours. Google says DKIM can take up to 48 hours to start working after you add the record.

What DMARC policy should a small business start with? p=none with a rua address for reports. It doesn't ask receivers to block anything, but the reports show who is sending as your domain. Tighten to quarantine, then reject, once only your real senders appear.

Sources

• Google Workspace: set up SPF, set up DKIM, set up DMARC
• Microsoft Learn: SPF, DKIM, DMARC
• GoDaddy Help: add a TXT record, SPF, DKIM and DMARC for Professional Email
• Gmail: email sender guidelines
• RFC 7208 (SPF) and RFC 7489 (DMARC)