Set up SPF, DKIM and DMARC.

The three DNS records every sending domain needs, with steps for Google, Microsoft and Zoho.

Google and Yahoo require these three records from anyone who sends a lot of email. Without them, your emails go to spam or are refused.

You add them where your domain’s DNS is managed, for example Cloudflare, GoDaddy or Namecheap.

SPF: who may send for your domain

Add one TXT record on your domain:

Google Workspace: v=spf1 include:_spf.google.com ~all
Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
Zoho (India): v=spf1 include:zoho.in ~all (use zoho.com outside India)
Other providers: their help pages list the include.

Only one SPF record. If you already have one, add the new include to it. For example: v=spf1 include:_spf.google.com include:zoho.in ~all.

DKIM: a signature on every email

Google: In Google Admin, open Apps, then Google Workspace, then Gmail, then Authenticate email. Generate a key, add the TXT record it shows, then click Start authentication.
Microsoft: In Microsoft Defender, open Email authentication settings, then DKIM. Add the two CNAME records it shows, then turn DKIM on.
Zoho: In Zoho Mail Admin, open Domains, then Email configuration, then DKIM. Add a selector, copy the TXT record to your DNS, then verify.
Other providers: turn on DKIM signing in their admin, then add the record they give you.

Choose a 2048-bit key when you can.

DMARC: what to do with fakes

Add a TXT record named _dmarc with the value v=DMARC1; p=none.

This is enough to start. After a few weeks of SPF and DKIM passing, change it to p=quarantine.

Check it worked

DNS changes can take up to an hour. Then open your domain on the Mailboxes page and click the refresh button. Each record shows a green tick, or the exact fix.

Common mistakes

Two SPF records. SPF fails. Merge them into one.
Too many lookups. SPF allows 10 DNS lookups. Remove includes for tools you no longer use.
Ending in +all. This lets anyone send as you. Use ~all or -all.