How to Fix SPF, DKIM and DMARC

What each record does

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a signature that proves a message wasn’t changed and came from your domain.
• DMARC tells receiving servers what to do when a message fails, and sends you reports.

Start by running your domain through the Email DNS Checker to see which of the three need work. Google and Yahoo now require these records from bulk senders, so missing ones can hurt delivery.

Fix SPF

SPF is a single TXT record on your root domain. It lists every service that sends your mail:

v=spf1 include:_spf.google.com ~all

Use the include value your provider gives you. The common mistakes are:

• Two SPF records. A domain may have only one. Merge them: v=spf1 include:_spf.google.com include:sendgrid.net ~all.
• Too many lookups. SPF allows 10 DNS lookups. Each include counts, along with any nested inside it. Remove services you no longer use.
• A forgotten sender. Newsletters, invoices and contact forms often send from other services. Add each one.

Fix DKIM

You don’t write DKIM yourself. Your email provider generates a key, and you publish it at an address like this:

selector._domainkey.example.com

Find the DKIM setting in your provider’s admin area, copy the record it gives you, then turn signing on there. If a check says DKIM is missing, it may just need the right selector, which varies by provider. To confirm, send yourself an email and read its headers with the Email Header Analyzer. Look for dkim=pass.

Fix DMARC

Add a TXT record at _dmarc.example.com. Start in monitoring mode, which changes nothing about delivery:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Move up in stages once the reports show your real mail passing:

1. p=none: watch the reports for a few weeks.
2. p=quarantine: failing mail goes to spam.
3. p=reject: failing mail is refused.

Don’t jump straight to p=reject. If a service you use isn’t covered by SPF and DKIM yet, its mail will disappear.

Check the result

DNS changes can take time to spread, so use the DNS Propagation Checker first, then run the Email DNS Checker again. For the final test, send a real email and confirm that SPF, DKIM and DMARC all pass in its headers.