SPF, DKIM and DMARC: the setup that keeps your business email out of spam.

What the three records actually do

SPF is a DNS record that lists which services are allowed to send email using your domain. When Gmail receives a message from you, it checks whether the sending server is on the list.

DKIM is a signature. Each sending service signs your messages with a private key, and publishes the public key in your DNS so receivers can verify that the message was not altered and really came from an authorized sender.

DMARC is the policy that ties them together. It tells receivers what to do when a message fails SPF and DKIM (nothing, quarantine, or reject), and where to send reports about who is sending as your domain. Without DMARC, SPF and DKIM are advisory. With it, they are enforced.

The records, service by service

Replace yourdomain.com with your domain. Publish these at your DNS host (Cloudflare, GoDaddy, Namecheap, Porkbun, Squarespace and others all have a DNS records page).

SPF (one TXT record at the root)

You get exactly one SPF record per domain. It must include every service that sends as you. A typical Google Workspace plus Klaviyo plus Shopify setup looks like this:

v=spf1 include:_spf.google.com include:_spf.klaviyo.com include:shops.shopify.com ~all

Two rules: never publish two SPF records (receivers treat that as a failure), and stay under ten DNS lookups in total. Every include costs at least one lookup, and some cost several. If you use many services, flatten or use a dedicated subdomain for marketing mail.

DKIM (one CNAME or TXT per sending service)

Each service gives you its own key records to publish:

• Google Workspace: generate the key in Admin console under Apps, Google Workspace, Gmail, Authenticate email. Publish the google._domainkey TXT record, then click "Start authentication".
• Klaviyo: add a dedicated sending domain (for example send.yourdomain.com) and publish the CNAME records it provides. This also fixes the "via klaviyomail.com" label.
• Shopify: under Settings, Notifications, Sender email, authenticate your domain and publish the CNAMEs Shopify shows.
• Stripe, HubSpot, helpdesks: each has a domain authentication page that produces CNAMEs. Publish every one, then verify inside the service.

DMARC (one TXT record at _dmarc)

Start in monitoring mode so you can see who is sending as you before you block anything:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Read the reports for two to four weeks. When every legitimate sender passes, move to p=quarantine, then p=reject. Reject is the goal; it is what stops other people from sending as your domain.

The mistakes we see most

• Two SPF records. Usually one from a previous host and one from the new one. Merge them into a single record.
• A forgotten sender. The CRM, the invoicing tool or the booking system sends as you and is not in SPF. Its messages fail quietly.
• DKIM enabled in the service but never published in DNS. The service shows a green check only after the record resolves. Verify from outside, not just inside the dashboard.
• DMARC set to reject on day one. Legitimate mail from an unlisted sender gets bounced. Monitor first.
• Marketing and transactional mail on the same domain and reputation. A bad campaign drags down your invoices. Use a subdomain for bulk mail.
• Nobody reads the reports. DMARC reports are XML. Use a report parser, or a monitor that turns them into a weekly summary and alerts on drift.

How to check your own domain in two minutes

Send a message from each service to a Gmail address you control, open the message, choose "Show original", and read the three lines at the top: SPF, DKIM and DMARC should each say PASS. If any says FAIL or is missing, that service is the one to fix. For a whole portfolio of domains, a scripted audit is faster. The one we built checks every record for a domain in under five seconds and grades it; it runs before every launch we do and on a schedule after.

When to bring someone in

If you are migrating mail hosts, moving DNS providers, or have more than three services sending as your domain, the cutover is where things break and a plan with a rollback is worth more than the records themselves. We do this as a fixed-price engagement, usually inside a week, and leave monitoring behind. See email deliverability.

Email deliverability service · Shopify development · Get a fixed-price proposal