What each record does
Email authentication consists of three DNS records that together prove messages from your domain are genuine:
- SPF (Sender Policy Framework) — lists IPs authorized to send as your domain
- DKIM (DomainKeys Identified Mail) — cryptographically signs each message
- DMARC — instructs receivers what to do when SPF/DKIM fails
Since Feb 2024, Gmail and Yahoo require all three for bulk senders (5,000+/day): SPF and DKIM must both pass, DMARC needs at least p=none, and the spam complaint rate must stay below 0.3% (Gmail recommends staying under 0.1%). Gmail additionally mandates one-click unsubscribe per RFC 8058 plus a visible unsubscribe link. Without them, emails land in spam — or are rejected outright.
Since May 2025, Microsoft Outlook.com (including Hotmail and Live) applies the same baseline to senders of more than 5,000 emails per day: SPF pass, a valid DKIM signature, and DMARC with at least p=none. And since November 2025, Gmail has tightened enforcement: non-compliant bulk mail is no longer just filtered, but rejected temporarily (SMTP 4.7.x) or permanently (e.g. 5.7.25).
Step 1: Set up SPF
SPF is a single TXT record on your root domain. The value starts with v=spf1 followed by mechanisms listing authorized senders, ending with an all rule.
Example for Google Workspace only:
v=spf1 include:_spf.google.com -allExample for Google Workspace + Mailchimp:
v=spf1 include:_spf.google.com include:servers.mcsv.net -allTags explained:
include:— delegate authorization to another domain's SPFip4:/ip6:— specific IPsa,mx— the domain's A or MX records-all— reject others (strict).~all— softfail (monitor first)
Step 2: Set up DKIM
DKIM requires your email provider to generate a keypair. You publish the public key as a DNS TXT record; the provider signs outgoing mail with the private key.
The record lives at: {selector}._domainkey.yourdomain.com
The "selector" is assigned by your provider — google for Google Workspace, selector1 and selector2 for Microsoft 365, k1 for Mailchimp, etc.
Example for Mailchimp: record at k1._domainkey.yourdomain.com:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD...Your email provider's admin panel will tell you the exact selector and key to publish. Most providers offer a one-click "DKIM setup" wizard that generates this for you.
Step 3: Set up DMARC
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receiving servers what to do when SPF or DKIM fails, and where to send reports.
Recommended starting policy (monitor-only):
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1Run this for at least 2 weeks. Review the rua reports (XML files emailed daily) to find misconfigured senders.
Once your reports look clean, tighten to quarantine:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100Maximum protection (after 1-2 months):
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100Step 4: Test everything
After publishing the records, verify with our free SPF/DKIM/DMARC checker. Or manually:
# Check SPF
dig TXT yourdomain.com +short
# Check DMARC
dig TXT _dmarc.yourdomain.com +short
# Check DKIM (need selector)
dig TXT selector._domainkey.yourdomain.com +shortSend a test email to check-auth@verifier.port25.com. It replies with a full authentication report — SPF, DKIM, DMARC, and extras like reverse-DNS.
Common setup mistakes
- Two SPF records — must combine into one
- Using
+all— allows anyone to spoof you. Never do this - Forgetting the include: for transactional senders (SendGrid, Amazon SES, Mailgun)
- DMARC without SPF or DKIM aligned — DMARC requires at least one to pass with the From-domain aligned
- Jumping straight to p=reject — always start with p=none to catch issues first
- Hosting newsletter on a subdomain without its own DMARC — the
sp=tag controls subdomain policy
Quick reference
- SPF with
-allcovering every legitimate sender - DKIM selectors published for every email provider
- DMARC at
p=quarantine(minimum) orp=reject - DMARC reports (rua) going to an inbox you actually read
FAQ
Do small senders need SPF, DKIM and DMARC too?
Yes. The formal bulk-sender rules from Gmail and Yahoo (since February 2024) and Microsoft Outlook.com (since May 2025) apply above roughly 5,000 emails per day, but all three records are the baseline for reliable delivery — without them your mail is far more likely to be filtered as spam.
What do Gmail and Yahoo require from bulk senders?
Since February 2024 bulk senders need SPF and DKIM (both), a DMARC policy of at least p=none, and a spam complaint rate below 0.3% (Gmail recommends staying under 0.1%). Gmail additionally mandates one-click unsubscribe per RFC 8058 plus a visible unsubscribe link. Since November 2025, Gmail enforces this strictly — with temporary (SMTP 4.7.x) and permanent rejections such as 5.7.25.
What does Microsoft Outlook.com require since May 2025?
Senders of more than 5,000 emails per day to Outlook.com, Hotmail or Live addresses need a passing SPF record, a valid DKIM signature and DMARC with at least p=none. Non-compliant mail is first routed to the junk folder and can later be rejected.
Which DMARC policy should I start with?
Start with p=none and rua reporting for at least two weeks, review the reports for misconfigured senders, then tighten to p=quarantine and finally p=reject once every legitimate mail passes.
Why is only one SPF record allowed per domain?
Multiple SPF records break SPF validation. Combine all senders into a single v=spf1 record using include: mechanisms.
