SPF, DKIM and DMARC for small businesses: set them up so your emails arrive

SPF, DKIM and DMARC are three DNS records that prove your emails really come from your business. SPF lists the services allowed to send for your domain, DKIM adds a digital signature to each message, and DMARC tells receiving mail servers what to do when a message fails those checks. Gmail requires every sender to have at least SPF or DKIM, and bulk senders to Gmail, Yahoo and Outlook.com need all three. Setting them up takes about an hour and mainly involves copying values from your email provider into your domain's DNS settings.

What each record does, in plain English

DMARC adds one important idea: alignment. The domain in the visible From address must match the domain that passed SPF or DKIM. Without alignment, a criminal could pass SPF for their own domain while showing your name in the From line. DMARC passes if SPF or DKIM passes in alignment.

The UK's National Cyber Security Centre (NCSC) recommends all three as part of its email security and anti-spoofing guidance.

What Gmail, Yahoo and Microsoft now require

Since February 2024, Google and Yahoo have required senders to authenticate their mail. Microsoft followed for Outlook.com in May 2025. These rules apply to mail sent to personal mailboxes (such as @gmail.com, @yahoo.com, @outlook.com and @hotmail.com), but meeting them also helps with business recipients.

Notes on the table:

• Google recommends keeping the spam rate in Postmaster Tools below 0.1% and never reaching 0.3%. It also requires DKIM keys of at least 1024 bits and recommends 2048 bits.
• Yahoo does not publish a numeric threshold for "bulk sender". It requires every sender to use at least SPF or DKIM.
• Microsoft said that from 5 May 2025 non-compliant messages from high-volume domains would go to Junk, and that it would later reject them with the error 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. If you see that error in a bounce, your authentication is the cause.
• Providers update these rules. Check the official pages linked at the end of this guide before relying on a detail.

The 5,000 figure counts all mail from your domain, including newsletters and automated mail from your website, booking system or shop. A small business can pass it during a busy campaign without noticing.

Before you start: list everything that sends email as you

Make a list of every service that sends email using your domain in the From address. For a small business that is often:

• Your mailbox provider (Google Workspace or Microsoft 365)
• Your newsletter tool
• Your website's contact form (WordPress, Wix or Squarespace notifications)
• Booking, invoicing, accounting or CRM software
• Your online shop (order confirmations)

Each one needs to be covered by SPF, DKIM or both. Most services have a help page called something like "authenticate your domain" with the exact records to add.

Step-by-step: Google Workspace

1. SPF

In your domain's DNS settings (at your registrar or DNS host), add or edit the TXT record on the root of your domain. If Google Workspace is your only sender:

v=spf1 include:_spf.google.com ~all

If you already have an SPF record, add include:_spf.google.com to it. Do not create a second record.

2. DKIM

1. Sign in to the Google Admin console as a super administrator.
2. Go to Menu > Apps > Google Workspace > Gmail and click Authenticate email.
3. Choose your domain and click Generate new record. Choose a 2048-bit key if your DNS host supports it; otherwise 1024-bit. Keep the default prefix (selector) google unless you already use it.
4. Copy the TXT record name (google._domainkey) and value into your DNS settings.
5. Return to Authenticate email and click Start authentication. Google says it can take up to 48 hours to start working, and the page may show "You must update the DNS records" in the meantime.

3. DMARC

Add a TXT record with the name _dmarc (so it sits at _dmarc.yourdomain). See the example records below.

Step-by-step: Microsoft 365

1. SPF

Microsoft's documentation gives this record for a domain that only sends from Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Microsoft recommends -all (hard fail) because you will also set up DKIM and DMARC. There is no SPF setting inside Microsoft 365; you add the record at your DNS host.

2. DKIM

1. In the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, and open the DKIM tab. Or go straight to https://security.microsoft.com/authentication.
2. Select your custom domain. Microsoft shows two CNAME records to create, with the host names selector1._domainkey and selector2._domainkey.
3. Copy the exact "points to" values shown for your organisation into your DNS settings. The format has changed over time, so do not copy an example from elsewhere.
4. Back in the portal, switch DKIM signing on for the domain.

3. DMARC

Add a TXT record at _dmarc.yourdomain, as below. Microsoft also notes that for mail it sends using only your onmicrosoft.com domain, SPF is already set up for you.

Example records

Replace example.co.uk with your domain. These are examples, not values to copy blindly. Your providers' help pages give the exact entries.

What the DMARC tags mean:

• p=none: take no action, just report. p=quarantine: treat failures as suspicious, usually spam folder. p=reject: refuse failing mail.
• rua=: where to send daily aggregate reports. They arrive as XML files; a free or paid DMARC report service makes them readable.
• pct=: the percentage of failing mail the policy applies to, useful for a gradual move.

A parked domain that never sends email should have v=spf1 -all and a DMARC record with p=reject, so nobody can use it to impersonate you.

How to check your setup

1. Send a test email from each service on your list to a personal Gmail address.
2. In Gmail, open the message, click the three dots and choose Show original. Look for SPF: PASS, DKIM: PASS and DMARC: PASS. Check that the domains shown match your From domain.
3. Look up your records with a DNS lookup tool, or in a terminal: nslookup -type=txt example.co.uk and nslookup -type=txt _dmarc.example.co.uk.
4. Read your DMARC reports for two to four weeks before tightening the policy. They show every server sending as your domain, including ones you forgot.
5. Run a SiteVerdict check. SiteVerdict's email and domain health check reads your SPF, DKIM and DMARC records, flags common problems such as a missing or weak DMARC policy, and checks TLS on your mail setup.

Common mistakes

Moving from p=none to p=reject safely

DMARC only protects your domain once the policy is quarantine or reject. A cautious timetable for a small business:

1. Weeks 1 to 4: p=none. Collect aggregate reports. For every source sending as your domain, decide: is it yours? If yes, fix its SPF or DKIM so it passes in alignment. If no, it is someone spoofing you, which is exactly what DMARC will stop.
2. Weeks 5 to 8: p=quarantine. Optionally start with pct=25 and raise it. Watch for complaints that real emails are going to spam.
3. After that: p=reject. Keep reading reports, because new tools get added and forgotten.

Two things can cause surprises. Forwarding: when a recipient forwards your email automatically, SPF often fails because the forwarding server is not in your record. DKIM usually survives, which is why DKIM matters even if SPF passes. Subdomains: Microsoft notes that each subdomain that sends email needs its own SPF record, while subdomains inherit the parent domain's DMARC policy unless you set one for them. Sending newsletters from a subdomain such as news.example.co.uk keeps their reputation separate from your everyday email.

Why this matters for a small business

Most small businesses do not send 5,000 emails a day, but authentication still matters. Quotes, invoices and booking confirmations that land in spam cost you work. And without DMARC, anyone can send email that appears to come from your domain, including fake invoices to your own customers. Our research on UK small-business websites covers website faults; email authentication is a separate check, and SiteVerdict tests it alongside your website.

Related guides

• "Not secure" warning: what it means and how to fix it
• UK cookie law for small businesses in 2026
• Is your website ready for AI search?