SPF, DKIM and DMARC for your sending domain

What the domain check looks at, the records to publish for Google and Microsoft, and how to read the results.

Mailbox providers check that a message really comes from your domain. Three DNS records prove it: SPF (which servers may send), DKIM (a signature on every message) and DMARC (what receivers should do when those checks fail). Google and Yahoo require all three for bulk senders since 2024.

Email accounts → Domains checks every domain you send from right after you connect an account and then daily. You can press Check now after changing DNS (changes can take up to a few hours to be visible).

SPF

Publish exactly one TXT record starting with v=spf1 on the domain. Include your mailbox provider and end with ~all or -all:

SPF include per provider
Provider	Example record
Google Workspace	`v=spf1 include:_spf.google.com ~all`
Microsoft 365	`v=spf1 include:spf.protection.outlook.com -all`
Zoho Mail	`v=spf1 include:zoho.com ~all` (EU: `zoho.eu`)

Two v=spf1 records make SPF fail: merge them into one.
SPF allows at most 10 DNS lookups (include, a, mx, ptr, exists, redirect); the check fails above 10 and warns from 8.
+all lets anyone send as you and fails the check; ?all or no all is a warning.

DKIM

Turn on DKIM signing at your provider; it gives you the record to publish.

Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record, publish the TXT at google._domainkey, then Start authentication.
Microsoft 365: Microsoft Defender portal → Email authentication settings → DKIM; publish the two CNAMEs selector1._domainkey and selector2._domainkey, then enable signing.
Other providers: publish the TXT or CNAME they give you. If they use an unusual selector, add it as a custom selector on the Domains page so the check finds it.

DMARC

Publish a TXT record at _dmarc.<your domain>. Start by monitoring, then tighten:

Start (monitoring)

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Once SPF and DKIM pass

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com

The check passes with p=quarantine or p=reject, warns with p=none, and fails without a record. A subdomain inherits the policy of its organizational domain.

MX

The domain needs MX records so replies and bounces can reach you. The check warns when the MX records don't point at the provider of the accounts using the domain.

Tip: send cold outreach from a separate domain (for example getacme.com next to acme.com) so your main domain's reputation is protected. Set up the same three records on it.