IN 30 SECONDSFull read: 2 min
- SPF lists who may send for your domain, DKIM signs each message, DMARC enforces both.
- Get the records from your email provider and add them as TXT records at your DNS host.
- Use a separate mailbox for DMARC reports, and test with LearnDMARC or MXToolbox.
Email authentication is one of the most important yet often overlooked parts of domain security. If SPF, DKIM, and DMARC are not configured correctly, your emails may land in spam or be rejected entirely, even if you're using trusted platforms like Microsoft 365 or Google Workspace.
Every time you send an email, the receiving mail server asks a simple question: Can this domain be trusted? SPF, DKIM, and DMARC are the mechanisms that help answer that question clearly and securely.
Watch the Full Explanation#
SPF: Sender Policy Framework#
Defines which mail servers are allowed to send emails on behalf of your domain. If a server isn't listed in your SPF record, receiving servers may treat the email as suspicious or block it.
DKIM: DomainKeys Identified Mail#
Adds a digital signature to each email. This signature allows the receiving server to verify that the message was not modified after it was sent.
DMARC: Domain-based Authentication#
Brings SPF and DKIM together. It tells receiving servers what to do if authentication fails, such as do nothing, send to spam, or reject the message completely. It also provides reporting so you can monitor email activity on your domain.
How to Configure SPF, DKIM, and DMARC#
1. Get DNS Records from Your Email Provider#
Your email provider (Microsoft 365, Google Workspace, etc.) will provide the specific DNS records you need. These records are unique to your domain and email service.
2. Access Your Domain DNS Manager#
Log in to your domain registrar or DNS hosting provider. This is where your domain's DNS records are managed, such as GoDaddy, Namecheap, Cloudflare, or your hosting provider.
3. Add the Records to Your DNS#
Copy the SPF, DKIM, and DMARC records provided by your email service and add them as TXT records in your DNS manager. Make sure to add them exactly as provided.
4. Wait for DNS Propagation#
DNS changes can take anywhere from a few minutes to 48 hours to fully propagate across the internet. Most changes appear within 1 to 4 hours.
DMARC Reporting Email Tip#
When setting up DMARC, you'll need to add an email address for receiving DMARC reports. Avoid using your main email address, as you may receive many automated reports. Instead, use a dedicated email you don't check often, or if you're on Microsoft 365, create a separate shared mailbox specifically for DMARC reports.
Test Your Configuration#
After adding your records, use these tools to verify that SPF, DKIM, and DMARC are configured correctly and passing authentication checks.
Rather have us do it for you?
A free 15-minute call. We look at your tenant and tell you what to fix first.
Book a Free CallWRITTEN BY
Ahmed Masoud, Founder & CEO
Ahmed and the MStack360 team deliver Microsoft 365 migrations, security and Power Platform projects for businesses across North America, Europe, Australia and the Middle East.