Skip to content

Practical security for real people & small teams

SPF, DKIM and DMARC explained, with a free checker and record generator

By , ICT engineer Published

Guide type
Guide + free tool
Risk if skipped
High
Time
30 min + 2–4 weeks of monitoring
Cost
Free
Works with
Any DNS host
Last verified
2026-10-05

The short answer

  • SPF lists the servers allowed to send email for your domain. DKIM signs each message so it cannot be altered. DMARC tells other mail systems what to do when a message fails both, and sends you reports.
  • Without them, anyone can send email that looks like it came from your business, and your own invoices are more likely to land in spam.
  • Use the checker below to see what your domain has today, then the generator to build the missing records. Start DMARC at p=none and tighten it over a few weeks.

1. Check a domain

Looks up the public SPF and DMARC records with Google Public DNS. Nothing is stored.

2. Build your records

Why a small business needs these three records

Email was designed without any proof of who sent a message. Anyone can put billing@yourbusiness.com in the "From" line. Criminals use this for fake invoices and "change of bank details" emails sent to your own customers and suppliers, a fraud the FBI reports as one of the most expensive types of cybercrime every year.

There is also a delivery cost. Since February 2024, Gmail requires every sender to use SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail users must also publish DMARC. Yahoo and Microsoft's Outlook.com have similar rules. A domain without them sees more of its own legitimate mail land in spam.

RecordAnswers the questionWhere it lives
SPF"Is this server allowed to send for this domain?"One TXT record on the domain itself (@)
DKIM"Was this message really signed by the domain, and not changed?"TXT or CNAME records your email provider gives you (for example google._domainkey)
DMARC"If a message fails, should I deliver, quarantine or reject it? And where do I send a report?"One TXT record at _dmarc

Set up SPF

  1. List every service that sends email as your domain

    Your mailbox provider (Google Workspace or Microsoft 365), plus anything that sends invoices, receipts, newsletters or website forms "from" your address: accounting software, the online shop, a CRM. Check each one's help pages for the SPF value it needs. Many newsletter tools send from their own domain and only ask for DKIM.

  2. Build one record

    Use the generator above. Google Workspace alone is v=spf1 include:_spf.google.com ~all; Microsoft 365 alone is v=spf1 include:spf.protection.outlook.com -all. If you use both, or extra services, they all go into the same single record.

  3. Publish it at your DNS host

    Sign in where your domain's DNS is managed (often the company you bought the domain from), add or edit the TXT record on the root of the domain (shown as @ or left blank), and save. If an SPF record already exists, edit it instead of adding a second one.

  4. Check the 10-lookup limit

    Each include:, a, mx, exists and redirect costs at least one DNS lookup, and includes can contain more includes. Above 10, SPF fails for every message. The checker above counts nested lookups for you.

Turn on DKIM

DKIM keys are generated by your email provider, so there is nothing to "build". You copy the record the provider gives you into your DNS, then switch signing on.

  • Google Workspace: in the Admin console, go to Apps › Google Workspace › Gmail › Authenticate email, generate a 2048-bit key, publish the TXT record at google._domainkey, then click Start authentication. Google notes that a new Gmail setup may need 24–72 hours before a key can be generated.
  • Microsoft 365: in the Microsoft Defender portal, go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings › DKIM. Publish the two CNAME records it shows (selector1._domainkey and selector2._domainkey), then enable signing for the domain.
  • Other services (newsletter tools, transactional email): look for "domain authentication" in their settings. It usually means two or three CNAME records.

Roll out DMARC without losing mail

Google's recommended rollout, which we follow here, starts with monitoring and tightens in stages. Set up SPF and DKIM at least 48 hours before adding DMARC.

StageRecord valueHow longWhat to watch
1. Monitorv=DMARC1; p=none; rua=mailto:you@yourbusiness.com1–2 weeksReports listing every service that sends as you. Fix any legitimate one that fails.
2. Partial quarantinev=DMARC1; p=quarantine; pct=10; rua=…1 weekComplaints from staff or customers about missing mail.
3. Full quarantinev=DMARC1; p=quarantine; rua=…1–2 weeksSame, at full volume.
4. Rejectv=DMARC1; p=reject; rua=…PermanentReports now and then, especially after adding a new email service.

About the reports

DMARC reports arrive as zipped XML files, usually one per receiving company per day. Use a dedicated mailbox or alias for them. Several companies offer free tiers that turn them into readable dashboards; a small business rarely needs a paid plan.

Domains that never send email

Do you own extra domains for a website, an old brand or typo protection? Criminals like those because nobody watches them. Microsoft's guidance for these "parked" domains is an SPF record of v=spf1 -all, which means no server may send for them, plus a DMARC record of v=DMARC1; p=reject. Tick "never sends email" in the generator to get both.

Don't

  • Don't publish two SPF records "to be safe". Two records is an error and both are ignored.
  • Don't jump straight to p=reject. A forgotten invoicing tool will silently stop reaching customers.
  • Don't use +all or ?all. They make SPF meaningless.
  • Don't delete an old SPF include until you are sure that service stopped sending. DMARC reports will tell you.

Email authentication is item 6 of our small business cybersecurity checklist. It protects your customers from fake invoices; teach your staff to spot the ones aimed at them with our guides on phishing and AI voice clone scams, which are increasingly used to "confirm" a fake payment request by phone.

How we checked this

Written by Ariel, ICT engineer. On 2026-10-05 we tested the checker in Chrome on Windows 10 against domains with strict DMARC (google.com, microsoft.com), a domain with no records, and a domain with a nested SPF include, and compared its lookup count with the rules in RFC 7208 and Microsoft's documentation. The checker counts include, a, mx, ptr, exists and redirect terms; it does not count the extra lookups that an mx term can trigger, so treat 9–10 as "at the limit". Provider SPF values were taken from each provider's documentation. Records are looked up through Google Public DNS. This page contains no affiliate links.

Sources