Set up SPF, DKIM and DMARC.
The three DNS records every sending domain needs, with exact steps for Google Workspace, Microsoft 365 and Zoho.
Three DNS records tell Google and Microsoft that your emails really come from you. Without them, your mail can go to spam or be rejected. Each one takes a few minutes to add.
| Record | What it does | Where it goes |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain. | A TXT record on your domain |
| DKIM | Adds a digital signature to every email, so it can't be faked. | A TXT or CNAME record your email provider gives you |
| DMARC | Tells inboxes what to do if SPF or DKIM fails, and sends you reports. | A TXT record named _dmarc |
You add these where you manage your domain's DNS, for example Cloudflare, GoDaddy or your registrar.
Google Workspace
SPF
Add a TXT record on your domain with the value v=spf1 include:_spf.google.com ~all. If you already have an SPF record, add the include to it instead. A domain should have only one SPF record.
DKIM
- In Google Admin, open Apps, then Google Workspace, then Gmail, then Authenticate email.
- Generate a new record and add the TXT record it shows to your DNS.
- Wait for it to show up, then click Start authentication.
Microsoft 365
SPF
Add a TXT record on your domain with the value v=spf1 include:spf.protection.outlook.com -all, or add the include to your existing SPF record.
DKIM
- In Microsoft Defender, open Email authentication settings, then DKIM.
- Choose your domain and add the two CNAME records it shows to your DNS.
- Turn DKIM signing on.
Zoho Mail
SPF
Add a TXT record with v=spf1 include:zoho.in ~all for Indian accounts, or include:zoho.com outside India.
DKIM
- In Zoho Mail Admin, open Domains, then Email configuration, then DKIM.
- Add a selector, copy the TXT record to your DNS, then click Verify.
DMARC, for every provider
Add a TXT record named _dmarc with the value v=DMARC1; p=none. This is enough to meet Google's and Yahoo's rules. Once everything passes for a few weeks, you can make it stricter with p=quarantine.
Four things that go wrong quietly
- Too many SPF lookups. SPF allows 10 DNS lookups. Each include can use several. Go over 10 and SPF fails for everyone. Remove includes for tools you no longer use.
- A short DKIM key. Use a 2048-bit key. Older 1024-bit keys still work, but are weaker. Your provider can make a new one.
- DMARC stuck at p=none. It's the right start. After a few weeks of passing, move to
p=quarantine. It shows mailbox providers you're serious. - A brand-new domain. Domains younger than 30 days are distrusted. Send very little from them until they're older.
Check it worked
DNS changes can take up to an hour to show. In GTM and Outreach, open Mailboxes, then Domain details, and click refresh. Each record shows a green tick when it's found, or the exact fix when it isn't. We also check every day: SPF lookups, DKIM key size, DMARC policy, domain age, the Spamhaus blocklists, and, for SMTP mailboxes, your provider's sending server and its reverse DNS.
Using several providers or tools?
Keep one SPF record and add each provider's include to it, for example v=spf1 include:_spf.google.com include:zoho.in ~all. DKIM and DMARC don't conflict: each provider has its own DKIM record, and you have one DMARC record.