By the Seovoro Team · Last updated October 27, 2026
Key takeaways
- SPF lists who may send email for your domain, DKIM signs your emails, and DMARC says what to do when the checks fail.
- Since 2024, Gmail and Yahoo require authentication from bulk senders.
- Start DMARC at p=none, read the reports, then tighten the policy.
- SPF allows only 10 DNS lookups, so too many includes will break it.
You send an email and it lands in spam, or never arrives. Often the cause is missing email authentication. Three DNS records fix most of it: SPF, DKIM and DMARC. They are not hard once you know what each one does.
In this guide
- What each record does
- Why it matters
- Setup order
- Check your setup
- Common mistakes
- Reading a DMARC report
- The "too many lookups" problem
- A small checklist before you send a campaign
- How Seovoro can help
- FAQ
- Sources
What each record does
- SPF lists the servers that are allowed to send email for your domain.
- DKIM adds a digital signature to your emails, so receivers can check they were not changed and really came from you.
- DMARC tells receivers what to do if SPF or DKIM fail (nothing, quarantine or reject), and sends you reports.
Why it matters
Since 2024, Gmail and Yahoo have required authentication for bulk senders, and missing records hurt delivery for smaller senders too. It also protects your brand, because without these records anyone can send emails that look like they came from your domain.
Setup order
1. Find out what sends email for your domain
Typical senders: your mailbox provider (Google Workspace, Microsoft 365, your hosting email), your newsletter tool and your invoicing or CRM tool. Make a list.
2. Set up SPF
SPF is a TXT record on your domain. It looks like this (the exact include depends on your provider):
v=spf1 include:_spf.google.com ~all
You can have only one SPF record. If you use several senders, combine them in the same record.
3. Set up DKIM
Your email provider gives you a key to add as a DNS record (usually a TXT or CNAME with a name like selector._domainkey). Turn on signing in the provider's settings after you add it. Repeat for each sender.
4. Add DMARC, starting gently
Add a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Start with p=none, which only monitors. Read the reports for a few weeks to make sure all your real senders pass. Then move to p=quarantine and later p=reject.
Check your setup
- Send a test email to a free tester such as mail-tester.com and read the report.
- In Gmail, open a message, choose "Show original" and look for SPF, DKIM and DMARC "PASS".
- Use a domain health checker to look up your records and spot errors quickly.
Common mistakes
- Two SPF records instead of one.
- Forgetting a sender, such as the tool that sends your invoices.
- Jumping straight to
p=rejectand blocking your own legitimate emails. - Making a DNS change and never testing it.
Reading a DMARC report
The reports you get at the address in rua arrive as small XML files from big mail providers. Raw files are hard to read, so most people use a free DMARC report viewer. What to look for: which sending sources appear, and whether each passes SPF and DKIM. If you see a source you do not recognize, someone may be sending email using your domain.
The "too many lookups" problem
SPF allows up to 10 DNS lookups. Each "include" can use several. If you add too many email services, your SPF record can break and fail validation. Fix it by removing services you no longer use, or by using a service that flattens SPF records for you.
A small checklist before you send a campaign
- SPF record is present and valid.
- DKIM is turned on for the service that sends the email.
- DMARC is in place, at least at
p=none. - The "From" address uses your own domain, not a free address.
- There is an easy unsubscribe link and a postal address in marketing emails.
- You tested with a free email tester and sent test emails to Gmail and Outlook.
How Seovoro can help
Our domain health bot checks these records for many domains at once. For a one-off review of your site and setup, ask for a free audit.
FAQ
Do I need all three?
Yes. They work together. SPF and DKIM prove who you are, DMARC says what to do when the proof fails.
Will this guarantee inbox delivery?
No. It removes a major cause of spam placement, but content, sending habits and list quality matter too.
Can I break my email by setting this up?
Wrong records can. That is why you start DMARC on p=none and test before tightening.
Sources
- Google Workspace Admin Help: Email sender guidelines
- Google Workspace Admin Help: Set up DMARC
- IETF: RFC 7208: Sender Policy Framework (SPF)
- IETF: RFC 7489: DMARC
Want a second pair of eyes on your website? Request a free technical SEO audit or run our free Site Audit now.
Written by Seovoro SEO Team
SEO, AEO & AI Search specialists at Seovoro. View author profile