+1 coinfor reading to the end
+1
Your business

SPF, DKIM and DMARC, done yourself

Three DNS records decide whether a scammer can send email in your name. Your free scan shows which ones you have. This page is for the business owner who chose GUIDE ME and wants to set them up alone, in the order that keeps real mail flowing. If you would rather not, Fix it once puts them right for $199 and Managed Domain keeps them right for $25 a month per sending domain.

The order matters. SPF first, DKIM second, DMARC last, and DMARC starts in watch mode. Jumping straight to the strict setting is how people block their own invoices.

What each one does

Record What it says What our scan calls a pass
SPF Which services may send mail from your domain One record starting v=spf1. Full marks for -all at the end, most marks for ~all, one mark for ?all. Two SPF records, or +all, fails.
DKIM A signature on every message that proves it was not changed on the way A published key at your mail provider’s selector.
DMARC What a receiving mailbox should do with mail that fails the first two A record at _dmarc starting v=DMARC1. Full marks only at p=reject with no percentage limit. p=quarantine and p=none count as weak.

10 out of 10 is SPF with -all, DKIM on, and DMARC at p=reject. From 8 the scan reads Protected. A domain that already scans 10/10 gets the Managed Domain setup fee waived.

Where to add records: at whoever runs your DNS. If your DNS is on Cloudflare, that is the domain’s DNS records page. One record at a time, then re-check.

Steps

  1. SPF: list every sender. Write down everything that sends mail as your domain: your mail provider, your website's contact form, your newsletter tool, your invoicing app. Each one needs an entry, and a record can hold at most ten include: entries.

  2. SPF: add one TXT record at the root of your domain. Google Workspace only: v=spf1 include:_spf.google.com ~all. Microsoft 365 only: v=spf1 include:spf.protection.outlook.com -all. Add an include: for each other sender before the all. Never have two SPF records; edit the one you have. Google's page recommends ~all. Our scan gives full marks for -all, so switch to it once you are sure every sender is listed.

  3. DKIM at Google Workspace. In the Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email. Pick your domain, select Generate New Record, keep 2048 bits and the prefix google, then Generate. Add the host name and TXT value it shows as a TXT record in your DNS. Using DreamHost, Zoho Mail or Bluehost for email? See [how to get your key from your host](/docs/domains/dkim-dreamhost/) ([Zoho Mail](/docs/domains/dkim-zoho/), [Bluehost](/docs/domains/dkim-bluehost/)). Come back and select Start authentication. The status should read Authenticating email with DKIM. A brand-new Google Workspace domain has to wait 24 to 72 hours before the key can be made. Google's steps.

  4. DKIM at Microsoft 365. Open Email authentication settings in the Defender portal and select the DKIM tab. In your domain's row, slide the toggle to Enabled. A dialog shows the two CNAME values; select OK, open the row, and use Copy under Publish CNAMEs. Add both as CNAME records in your DNS: selector1._domainkey and selector2._domainkey. Wait a few minutes, come back, and turn on Sign messages for this domain with DKIM signatures. Microsoft's steps.

  5. DMARC: start in watch mode. Add a TXT record named _dmarc with v=DMARC1; p=none; rua=mailto:an-address-you-read@yourdomain. Nothing is blocked yet. Reports start arriving at that address, as machine-readable files, and they tell you which senders fail.

  6. DMARC: turn it up, twice. After a couple of weeks with no real sender failing, change p=none to p=quarantine. Fakes now land in junk. After a couple more clean weeks, change it to p=reject. Fakes are now refused. Our own engine refuses to jump from none straight to reject, and so should you.

  7. Check. Run the free scan at teamwildcard.ca/scan/yourdomain, or open the domain's row on your portal's Domains page. SPF, DKIM and DMARC each show Pass, Weak, Fail or Missing, with the score out of 10.

What happens next

  • Mail from your real senders keeps arriving. Mail from fakes gets junked, then refused.
  • A new sender later (a new invoicing app, a new newsletter tool) needs an include: in SPF and, often, its own DKIM record. Add those before the first send, or it will fail DMARC.
  • If you move to Managed Domain, we take over the ramp from wherever you are and read the reports for you. See the DMARC ramp.