Setting Up SPF, DKIM and DMARC for Email Delivery

When quotes, invoices or newsletters end up in spam, the cause is often not the content but missing authentication. Google, Yahoo and Microsoft now require senders to prove their emails are genuine using SPF, DKIM and DMARC. This article explains the three methods, shows sample DNS records and summarises what the major mailbox providers currently require.

Why email authentication is necessary

SMTP, the protocol behind email, dates from a time when nobody expected abuse. Without additional checks, any server can send an email with any sender address, including your domain. Phishing attacks and fake invoices exploit exactly that.

SPF, DKIM and DMARC are records in DNS, the internet's address book. Receiving servers read them to check whether an email really comes from you.

SPF: who may send for your domain?

SPF (Sender Policy Framework) is a list of servers allowed to send email for your domain. It is a TXT record on the domain itself.

example.de.  TXT  "v=spf1 mx include:_spf.mailprovider.example ~all"

What the parts mean:

• v=spf1 identifies the record as SPF.
• mx authorises the mail servers listed in the domain's MX record.
• include: pulls in a service provider's list, for example your email provider or newsletter tool.
• ~all marks all other senders as suspicious. With -all they are rejected outright.

Important: there may be only one SPF record per domain. The standard also limits the number of DNS lookups during evaluation to ten. If you include many services, you will hit that limit quickly.

DKIM: the digital signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The sending server signs with a private key, and you publish the public key in DNS. The recipient uses it to check whether the email was altered in transit and whether it came from an authorised system.

mail2026._domainkey.example.de.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

The first part, here mail2026, is the selector. It allows several keys in parallel, for instance for your email provider and your newsletter tool. The key itself is usually generated by the service; you only add it to DNS. Google requires a key length of at least 1,024 bits and recommends 2,048 bits.

DMARC: policy and reporting

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the visible From address. An email only passes DMARC if SPF or DKIM passes and the authenticated domain matches the domain in the From header. This match is called alignment.

_dmarc.example.de.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.de"

The key settings:

• p= defines what happens to failing emails: none (monitor only), quarantine (send to spam) or reject.
• rua= is the address for daily aggregate reports. They show which servers send on your behalf and whether checks pass.

Start with p=none and analyse the reports for a few weeks. Only once all legitimate senders are properly authenticated should you tighten the policy step by step to quarantine and later reject.

What Google, Yahoo and Microsoft require

The major mailbox providers have tightened their requirements in recent years (as of November 2026):

Some details:

• Google also requires valid forward and reverse DNS for sending IP addresses and transmission over TLS for all senders. Google recommends keeping the spam rate below 0.1 percent and avoiding 0.3 percent or more.
• One-click unsubscribe means the headers List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click as defined in RFC 8058. Good newsletter tools add them automatically.
• Microsoft initially routes non-compliant email from bulk senders to Outlook.com, Hotmail.com and Live.com into the junk folder. It has announced that rejection will follow.

Even if your company does not send 5,000 emails a day, it pays to set up all three. The bulk sender requirements have effectively become the benchmark for good deliverability.

Step-by-step setup

1. List all senders: record every system that sends email using your domain: email provider, newsletter tool, online shop, CRM, accounting software, website contact form.
2. Create SPF: combine all senders into a single SPF record and check the number of DNS lookups.
3. Enable DKIM: activate DKIM in every service and add the keys it shows you to DNS.
4. Start DMARC with p=none: create the DMARC record with a reporting address.
5. Analyse reports: over a few weeks, check that all legitimate sources pass SPF or DKIM with alignment. Specialised tools help you read the XML reports.
6. Tighten the policy: move to p=quarantine and later p=reject.
7. Protect unused domains: domains that never send email get v=spf1 -all and a DMARC policy with p=reject.
8. Review regularly: any new tool that sends email must be added to SPF and DKIM before it goes live.

Managed email with Simplify Data

With our managed email and groupware service, we set up SPF, DKIM and DMARC for your domain and keep an eye on the reports. That keeps deliverability stable even as new systems are added. View business mail

Sources

• Google: Email sender guidelines
• Yahoo Sender Hub: Best practices
• Microsoft: New requirements for high-volume senders to Outlook.com
• RFC 7489: DMARC