How to Set Up SPF, DKIM and DMARC to Stop Email Spoofing

Anyone can type your company’s name into the “From” line of an email. Without the right settings on your domain, receiving mail servers have no reliable way to tell a real message from a forgery. Three free DNS records, SPF, DKIM and DMARC, close that gap. US agencies CISA and the FBI specifically recommend DMARC as a defence against spoofing. This guide is for small business owners and the person who manages email and the website domain, whether you use Google Workspace or Microsoft 365.

What each record does

• SPF (Sender Policy Framework): a TXT record listing the services allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail): a digital signature added to each outgoing email. Receivers check it against a public key in your DNS.
• DMARC: a policy that tells receivers what to do when a message fails SPF and DKIM checks: just report it, send it to spam (quarantine) or reject it.

Before you start

• DNS access for your domain, usually at your registrar or hosting provider.
• Admin access to Google Workspace (super administrator) or Microsoft 365.
• A list of every service that sends email as your domain: your main mailbox provider, plus newsletters, invoicing or accounting software, website contact forms, CRMs and office scanners.
• Patience. DNS changes can take up to 48 hours to spread.

Step 1: Publish one SPF record

Create a TXT record at the root of your domain (the host name is usually @).

Google Workspace

Use: v=spf1 include:_spf.google.com ~all

Microsoft 365

Microsoft recommends: v=spf1 include:spf.protection.outlook.com -all

Rules that prevent problems

• Publish only one SPF record per domain. Two records cause SPF to fail.
• Add other senders to the same record. Fixed IP addresses use ip4: (for example, ip4:203.0.113.10), while email services usually give you an include: value.
• Stay under 10 DNS lookups. Each include:, a, mx and redirect counts; ip4: and ip6: do not. Exceeding the limit causes an error and lost mail.
• On ~all versus -all: “~all” (soft fail) marks unlisted senders as suspicious, while “-all” (hard fail) says they are not authorised. Microsoft recommends -all because DMARC acts more reliably on hard failures.

Step 2: Turn on DKIM signing

Google Workspace

1. In the Google Admin console, go to Apps > Google Workspace > Gmail and click Authenticate email.
2. Choose your domain in Selected domain, click Generate New Record, select 2048-bit and click Generate. (Use 1024 only if your DNS host cannot accept the longer value.)
3. Copy the DNS Host name (normally starting with google._domainkey) and the TXT record value.
4. Create a TXT record at your DNS provider with those values.
5. Return to Authenticate email and click Start authentication. The status should change to “Authenticating email with DKIM”.

If Gmail was only just enabled for your organisation, the key may take 24 to 72 hours to become available.

Microsoft 365

1. Open the Microsoft Defender portal and go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then the DKIM tab.
2. Click your domain’s row (not the toggle) to open its details, and copy the two values under Publish CNAMEs.
3. At your DNS provider, create two CNAME records (not TXT): selector1._domainkey and selector2._domainkey, each pointing to the values Microsoft gave you.
4. Back in the details panel, turn on Sign messages for this domain with DKIM signatures. The status should read “Signing DKIM signatures for this domain”.

Tips from Microsoft: create both selectors, use a TTL of at least 3600 seconds, enter only selector1._domainkey as the host name if your provider adds the domain automatically, and on Cloudflare set the record to DNS only.

Remember that other services that send mail as your domain, such as newsletter tools, usually have their own DKIM setup steps. Complete those too.

Step 3: Publish DMARC in monitoring mode

Wait until SPF and DKIM have been live for about 48 hours. Then create a TXT record with the host name _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

• p=none blocks nothing. It only asks receivers to send you reports.
• rua= is where reports go. Create that mailbox or group first, or use a free DMARC reporting service, because raw reports are hard to read.

Step 4: Tighten the policy gradually

1. Read the reports for a few weeks. Look for genuine services that fail, such as an invoicing tool you forgot, and fix their SPF or DKIM.
2. Move to p=quarantine; pct=5, so only a small share of failing mail goes to spam, and increase the percentage step by step.
3. Finish at p=reject, which tells receivers to refuse forged mail.

If every email for your domain goes through Google Workspace or Microsoft 365 and nothing else, you can move faster, but monitoring first is the safer path for most businesses.

Step 5: Test it

• Send an email to a Gmail address, open it and choose Show original. SPF, DKIM and DMARC should all show PASS.
• In Outlook, view the message headers and look for the authentication results.
• Use an online SPF and DKIM checker with your DKIM selector (google for Google Workspace).

Troubleshooting

• SPF “permerror”: you probably have two SPF records or more than 10 lookups. Merge or simplify.
• DKIM not verifying: check that the host name was not doubled (for example google._domainkey.yourdomain.com.yourdomain.com) and that a long TXT value was not cut off.
• Admin console still warns after setup: Google may show an update notice for up to 48 hours; recheck after propagation.
• Website form emails start going to spam: the form’s sending service is missing from SPF or lacks DKIM. Add it before tightening DMARC.

Checklist

• One SPF record that lists every genuine sender
• DKIM signing on for your main mailbox provider and other senders
• DMARC at p=none with a working report address
• Reports reviewed and failures fixed
• Policy raised to quarantine, then reject
• Reminder set to review whenever you add a new email tool

Sources

• WebDogs: Set Up SPF, DKIM and DMARC for Google Workspace
• Microsoft Learn: Set up SPF for your custom domains
• Microsoft Learn: Set up DKIM to sign mail from your Microsoft 365 domain
• Cyber Security News: CISA and FBI detail phishing techniques

Featured image: Photo: “Google Analytics on Computer Screen” by bluefountainmedia, CC BY 2.0, via Openverse — source