How to set up SPF, DKIM and DMARC

Before you start

• DNS access
• Admin access to your email provider

The steps

1. 1

   Step 1: List every legitimate sender

   Your mail provider, your website’s form handler, any newsletter or CRM tool. Missing one causes its mail to fail.

2. 2

   Step 2: Publish an SPF record

   A single TXT record. One SPF record per domain — multiple records is a common and fatal misconfiguration.

3. 3

   Step 3: Enable DKIM

   Your provider gives you a key to publish as a TXT record at a selector subdomain.

4. 4

   Step 4: Add DMARC at p=none

   A TXT record at _dmarc.yourdomain.com with a rua address for reports. Nothing is rejected at this stage.

5. 5

   Step 5: Read the reports

   For at least four weeks. They show every source sending as you, including ones you forgot.

6. 6

   Step 6: Fix legitimate senders that fail

   Add them to SPF or enable DKIM for them.

7. 7

   Step 7: Move to p=quarantine

   Then to p=reject once reports are clean. Do not skip straight to reject.

Why this affects your website

Contact form notifications, order confirmations and password resets all send mail as your domain. Without alignment they land in spam, and the first symptom is usually "we never received your enquiry".

It is a brand protection measure

DMARC at p=reject stops anyone forging your domain in phishing mail. For a business whose customers expect invoices by email, that is worth the afternoon it costs.

Reading a DMARC report without a tool

The raw XML is legible if you are only checking a handful of sources: each record names a sending IP, a count, and whether SPF and DKIM aligned. Free parsers exist and are worth using once volume grows. What you are looking for is any source with a meaningful volume that fails alignment, because that is either a legitimate sender you forgot or someone forging your domain.

The background behind this

Technical SEO, in the order the problems actually block you covers the reasoning in about 4 minutes — free, ungated, written from client work.

Who wrote this

Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.