How to set up SPF, DKIM, and DMARC for your business email

SPF, DKIM, and DMARC are three DNS records that prove email from your domain is really from you. Together they stop criminals sending phishing emails that look like they come from your company, and they keep your own messages out of customers' spam folders. Setting them up takes an afternoon, costs nothing beyond your existing email service, and is now expected by Gmail, Outlook, and Yahoo for anyone who sends business email.

What each record does

SPF and DKIM each check one thing. DMARC ties them together: a message passes DMARC only if SPF or DKIM passes and the domain that passed matches the address in the "From" line that people see. That alignment check is what stops look-alike spoofing.

Before you start

1. Find out who hosts your DNS. This is often your domain registrar, but it may be Cloudflare, your web host, or a provider your previous IT company chose. You need to be able to add TXT and CNAME records.
2. List everything that sends email as your domain. Usually more than people expect: Microsoft 365 or Google Workspace, your website's contact forms, your accounting or ERP system, a newsletter tool, a CRM, the helpdesk, scanners, and printers that email documents.
3. Check what is already there. Look for an existing TXT record starting with v=spf1 and a record at _dmarc. A domain must have only one SPF record. Two SPF records make both invalid.

Step 1: Publish your SPF record

SPF is a single TXT record on your root domain that lists the services allowed to send for you, ending with a rule for everything else.

For Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

For Google Workspace:

v=spf1 include:_spf.google.com ~all

If other services send on your behalf, add their include: values (each provider documents its own) inside the same record:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

• -all tells receivers to reject mail from anywhere else. ~all (soft fail) asks them to treat it as suspicious. Start with ~all if you are unsure you have listed every sender, then tighten it.
• SPF allows a maximum of 10 DNS lookups. Each include: counts, and some providers use several. Go over the limit and SPF fails for everyone, so remove services you no longer use before adding new ones.

Step 2: Turn on DKIM

DKIM adds a digital signature to every message. The receiving server checks it against a public key in your DNS.

Microsoft 365. In the Microsoft Defender portal, open Email & collaboration, then Policies & rules, Threat policies, Email authentication settings, and the DKIM tab. Select your domain. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey. Add both at your DNS provider exactly as shown, wait for them to resolve, then switch on Sign messages for this domain with DKIM signatures.

Google Workspace. In the Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email. Choose your domain, generate a 2048-bit key, and add the TXT record Google shows (normally at google._domainkey). Once it has been published, return to the same page and click Start authentication.

Third-party senders such as newsletter tools, CRMs, and helpdesks have their own DKIM settings. Turn DKIM on in each one, so their mail can pass DMARC through DKIM even when SPF does not align.

Step 3: Add DMARC, starting in monitoring mode

Create a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:[email protected]

• p=none means "report only". Nothing is blocked yet, so it is safe to publish on day one.
• rua= is where receivers send daily aggregate reports. These are XML files; a DMARC reporting service, or your IT provider, turns them into a readable list of every server sending as your domain and whether it passed.

Step 4: Read the reports and fix the gaps

For two to four weeks, review the reports. You will usually find a system nobody listed, such as an old website plugin, a copier sending scans, or a supplier sending invoices on your behalf. For each one, either add it to SPF and turn on its DKIM signing, or stop it sending as your domain.

Step 5: Move to enforcement

When legitimate mail consistently passes, tighten the policy in stages:

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]

Raise pct to 100, then move to:

v=DMARC1; p=reject; rua=mailto:[email protected]

At p=reject, receivers refuse any message that claims to be from your domain but fails authentication. That is the point where spoofing your domain stops working. Keep reading the reports afterwards, because every new tool your company adopts needs adding before it sends.

Protect domains you don't send from. Parked or unused domains are popular for spoofing. Give them v=spf1 -all and v=DMARC1; p=reject; so nobody can send as them.

Check your setup

From any computer you can confirm the records are public:

nslookup -type=txt yourdomain.com
nslookup -type=txt _dmarc.yourdomain.com

Then send a message to a Gmail address, open it, choose Show original, and confirm that SPF, DKIM, and DMARC all show PASS.

Why it matters for Saudi businesses

Since 2024, Google and Yahoo require SPF, DKIM, and DMARC from bulk senders, and Microsoft applies similar rules to high-volume mail sent to Outlook.com. Smaller senders without them see more mail land in spam.

For Aramco and SABIC suppliers, SPF, DKIM, and DMARC are a stated requirement: general requirement TPC1.20 of SACS-210 asks every third party to implement them on its mail server. Auditors will check the DNS records directly. See our SACS-210 consultation service for the other email controls in the standard.

Frequently asked questions