How to set up SPF DKIM and DMARC: the three records in order, and how to check them

How to set up SPF DKIM and DMARC: the order

Set up SPF first, DKIM second and DMARC last: Google says SPF and DKIM should authenticate your mail for at least 48 hours before you turn DMARC on. DMARC also asks for alignment, which means the domain that passes SPF or DKIM must match the domain in the visible From address.

As read on October 23, 2026, Warmy's pricing page shows plans starting from $49 a month and lists a DMARC tracker in every plan; the tracker monitors SPF, DKIM and DMARC and shows the exact record to change. The Warmy review covers the rest.

Step 1: publish an SPF record

SPF is a TXT record added where your domain's DNS is managed, with @ as the host for the main domain.

1. List every service that sends mail for the domain, because Google says mail from a third-party sender missing from your SPF record is more likely to be marked as spam.
2. Publish one record. Google's example for a Google Workspace-only domain is v=spf1 include:_spf.google.com ~all. Microsoft's example for Microsoft 365 alone is v=spf1 include:spf.protection.outlook.com -all. Google says SPF can take up to 48 hours to start working.

Microsoft Learn allows one SPF record per domain or subdomain and asks for fewer than 10 DNS lookups.

Step 2: turn on DKIM signing

In Google Workspace, generate the DKIM key in the Admin console, choose 2048 bits if your domain provider supports it and 1024 otherwise, and publish it as a TXT record named with your selector followed by ._domainkey. Then click Start authentication. Google says DKIM can take up to 48 hours to start working.

Microsoft 365 signs no outbound mail from a custom domain until you set DKIM up with two CNAME records at your registrar. Gmail and Yahoo need a key of 1024 bits or more, and Yahoo asks bulk senders for both SPF and DKIM. Google says sending yourself a test message does not verify DKIM; the result shows in the Authentication-Results line of a message header.

Step 3: add DMARC at p=none, then tighten

Publish a TXT record at _dmarc.example.com, with your own domain in place of example.com. A starting record is v=DMARC1; p=none; plus an rua=mailto: tag that names a mailbox you control. The p=none policy delivers failing mail and logs it in daily reports. Google, Yahoo and Microsoft all accept p=none from bulk senders, provided the mail aligns with SPF or DKIM.

Tighten later. Microsoft suggests p=quarantine after enough monitoring, which sends failing mail to spam, and p=reject refuses it. Both also hit your own mail from a sender you forgot, so move only when the reports show every sender passing. DMARC is defined in RFC 9989, which replaces RFC 7489.

Step 4: read the reports and check the records

The rua tag names where DMARC reports go. Google recommends always including it, Yahoo strongly recommends it during setup, and Warmy's DMARC page says to expect first reports within one to two days. Gmail supports no failure reports (the ruf tag), and Microsoft plans none.

Warmy's DMARC Checker page says the tool is free, needs no sign-up and runs in your browser. Warmy checks DNS records but does not change them, so you still edit them at your own DNS host, and none of the three records needs a paid tool. See Gmail bulk sender requirements for who must have DMARC and why are my emails going to spam for what else to rule out.

EasyDMARC suits a team that wants DMARC monitoring alone: DMARC Plus is $44.99 a month on monthly billing, as read on October 23, 2026. Once the records pass, Warmy's pricing page lists a deliverability tester that checks authentication.