Free
Token calculator

SPF, DKIM and DMARC explained for small businesses

SPF, DKIM and DMARC are free DNS records that prove email is from you. Gmail requires SPF or DKIM from all senders, and all three above 5,000 emails a day.

By · Updated

SPF, DKIM and DMARC are three DNS records that let receiving mail servers check that a message claiming to come from your domain really did. SPF lists the servers allowed to send for you, DKIM adds a signature to each message, and DMARC tells receivers what to do when those checks fail. Since February 2024, Google requires every sender to Gmail accounts to use SPF or DKIM, and senders of 5,000 or more messages a day to use all three. None of these companies charges for the records themselves; you add them wherever your domain’s DNS is managed.

This guide is based on Google’s Gmail and Google Workspace help pages, Yahoo’s Sender Hub, Microsoft’s Defender for Office 365 documentation, Zoho Mail’s help pages and Cloudflare’s docs, all read October 31, 2026. AskGPU hasn’t set up these records on any of the providers named here; the steps and record values are the ones each company publishes.

What are SPF, DKIM and DMARC, in plain terms?

Record What it says Where it lives What the receiver checks
SPF “These servers may send mail for my domain.” One TXT record on the domain Whether the sending server is on the list
DKIM “Here is my public key; my messages carry a matching signature.” A TXT record (or CNAME) under a selector, such as google._domainkey Whether the signature in the message header is valid
DMARC “If a message fails, do this, and send me reports.” A TXT record at _dmarc Whether SPF or DKIM passed for the same domain as the visible From: address

SPF (Sender Policy Framework). Google describes it as preventing “spammers from sending unauthorized messages that appear to be from your domain.” The record must include every service that sends as your domain: your mailbox provider, your newsletter tool, your shop platform, your helpdesk.

DKIM (DomainKeys Identified Mail). Your email provider signs each outgoing message with a private key. The matching public key sits in your DNS. Google’s DKIM page puts it simply: the receiving server “gets the public key from the DKIM TXT record and uses the key to read the DKIM signature and authenticate the email.” Microsoft notes a practical advantage: because the signature travels inside the message, it usually survives forwarding, while SPF often doesn’t.

DMARC (Domain-based Message Authentication, Reporting and Conformance). Google’s sender guidelines say DMARC “tells receiving servers what to do with your messages that don’t pass SPF or DKIM.” To pass, a message must pass SPF or DKIM, and “the authenticating domain must be the same domain that appears in the message From: header.” That matching is called alignment, and it’s the part that stops someone from passing SPF with their own domain while showing yours in the From: line.

Do you need all three?

It depends on how much you send to personal Gmail and Yahoo addresses. Both companies published requirements that took effect in February 2024.

Requirement Google, all senders Google, 5,000+ a day Yahoo, all senders Yahoo, bulk senders
SPF SPF or DKIM Yes SPF or DKIM Yes
DKIM SPF or DKIM Yes SPF or DKIM Yes
DMARC Not required Yes, policy can be none Not required Yes, at least p=none, and DMARC must pass
From: domain aligned with SPF or DKIM Not stated Yes Not stated Yes (relaxed alignment is acceptable)
Spam complaint rate Below 0.3% Below 0.3% Below 0.3% Below 0.3%
Valid forward and reverse DNS (PTR) for sending IPs Yes Yes Yes Yes
One-click unsubscribe for marketing mail No Yes No Yes, honored within 2 days

A few details that matter for small businesses:

  • The 5,000 count is per primary domain. Google’s FAQ gives the example of 2,500 messages from solarmora.com and 2,500 from promotions.solarmora.com: together they make you a bulk sender.
  • Bulk status is permanent. Google says senders who cross the threshold even once “are permanently considered bulk senders.”
  • Enforcement got stricter. Google’s FAQ says that starting November 2025, “Gmail is ramping up its enforcement on non-compliant traffic,” including “temporary and permanent rejections.”
  • Workspace-to-Workspace mail is exempt, but not mail to Gmail. The rules apply to messages sent to personal Gmail accounts, including from Google Workspace users. They don’t apply to messages sent to Google Workspace accounts.
  • Key length. Google requires DKIM keys of at least 1,024 bits for Gmail and recommends 2,048 bits. Yahoo also asks for a minimum of 1,024 bits.

Google’s own advice goes further than its minimum: “we recommend that you always set up SPF, DKIM, and DMARC for your domains.” A small business sending a few hundred emails a day isn’t required to publish DMARC, but without it anyone can put your domain in a From: line and receivers have no instruction from you about what to do.

Why are my emails going to spam?

When legitimate mail from a business domain lands in spam, missing or broken authentication is one of the causes Google and Microsoft document. Check these in order:

  1. No SPF record, or a sender missing from it. Google says that if third-party senders “aren’t included in your SPF record, messages from these senders are more likely to be marked as spam.”
  2. Two SPF records. Microsoft and Zoho both state that only one SPF record is allowed per domain. Adding a second one for a new service, instead of editing the first, breaks SPF.
  3. Too many lookups. Microsoft’s docs say that if checking an SPF record needs more than 10 DNS lookups, the message “fails SPF with a permanent error.” Each include: costs at least one lookup. Google’s page says an SPF record “can have up to 10 include: tags.”
  4. DKIM not set up for your own domain. Microsoft notes that “the domain that DKIM uses to sign a message doesn’t need to match the domain in the From address.” A message signed only with a provider’s domain (Microsoft 365 signs with your *.onmicrosoft.com domain automatically) can pass DKIM without aligning with your From: domain, so it doesn’t help you pass DMARC.
  5. Gmail rejects with error 5.7.26. Google says unauthenticated messages “might be marked as spam or rejected with a 5.7.26 error.”
  6. High complaint rate. Above 0.3% in Google’s Postmaster Tools, Google says, has “an even greater negative impact” on delivery, and rates above 0.1% already hurt bulk senders.

Authentication isn’t the only factor. Google’s guidelines also cover message formatting, misleading display names and list hygiene. But fixing the three records is the part you can finish in an afternoon.

What do the records look like?

These are the values each provider publishes. Use the exact values shown in your own admin console where it gives them.

Provider SPF record DKIM Notes
Google Workspace v=spf1 include:_spf.google.com ~all TXT record at google._domainkey (default selector “google”), key generated in the Admin console Google recommends ~all. Wait 24-72 hours after turning on Gmail before generating the key
Microsoft 365 v=spf1 include:spf.protection.outlook.com -all Two CNAME records, selector1._domainkey and selector2._domainkey, values shown in the Defender portal Microsoft recommends -all
Zoho Mail v=spf1 include:zohomail.com -all (Zoho’s steps also give ~all) TXT record for a selector you create in Zoho’s admin console Zoho says there should be “only a single SPF record”
Domain that sends no email v=spf1 -all None Microsoft’s example for parked domains

If you use more than one sender, they go in the same record. Google’s examples include v=spf1 include:_spf.google.com include:servers.mcsv.net ~all for Google Workspace plus Mailchimp, and v=spf1 include:_spf.google.com include:shops.shopify.com ~all for Workspace plus Shopify.

~all or -all? The two big providers disagree. Google says ~all tells receivers to mark unlisted senders as spam and “recommends you use ~all.” Microsoft recommends -all (hard fail), because “the DMARC policy is effectively ignored for SPF ~all failures if the messages don’t also contain DKIM signatures.” Zoho shows both. If DKIM is set up and signing for your domain, the difference matters less; follow your mail provider’s instruction.

A DMARC record goes at the host _dmarc as a TXT record. A starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Google’s tag reference explains the parts. v and p are required and must come first. p is the policy: none delivers as normal and logs, quarantine sends failures to spam, and reject blocks them. rua is where daily aggregate reports go. pct sets what share of failing mail the policy applies to, and adkim and aspf set alignment to strict (s) or relaxed (r, the default).

How do you set them up, step by step?

  1. List every service that sends as your domain. Mailbox provider, newsletter, invoicing, shop, CRM, helpdesk, website contact forms. Each needs to be in SPF or sign with DKIM for your domain.
  2. Publish or fix SPF. One TXT record at your root domain (host @), with an include: for each sender. Google says it “can take up to 48 hours for SPF authentication to start working.”
  3. Turn on DKIM at each sender. In Google Workspace you generate the key in the Admin console, add the TXT record, then click to start authentication. Google says DKIM can also take up to 48 hours. If your domain is with Squarespace, Google says the key is created and added automatically. In Microsoft 365, the *.onmicrosoft.com domain is signed automatically, but custom domains need the two CNAME records.
  4. Publish DMARC at p=none with a report address. Google recommends starting at none and moving to quarantine or reject “over time.” Don’t use your personal inbox for reports: Google warns that rua “can potentially result in a high volume of report emails” and suggests a dedicated mailbox, a group or a reporting service.
  5. Read the reports, then tighten. Microsoft’s roll-out plan moves from p=none to p=quarantine, then to p=reject, and suggests raising pct in steps of 10, 25, 50, 75 and 100 at each stage.
  6. Protect domains you don’t send from. Microsoft recommends v=spf1 -all and a reject DMARC record on parked domains.

Where you click depends on your DNS host, which is usually your registrar unless you moved DNS elsewhere. If you’re not sure which is which, our guide to domains vs hosting explains the split.

What does it cost?

None of the Google, Microsoft, Yahoo or Zoho pages we read charge anything for the records themselves: they are DNS entries you add wherever your domain’s DNS is managed. The costs that do exist:

  • Your mail service. DKIM signing for your own domain comes with the business email plan. See what free business email leaves out and Google Workspace vs Microsoft 365 for 5 users for current per-user prices.
  • Report reading. DMARC aggregate reports arrive as data files that are hard to read by hand. Cloudflare’s DMARC Management, which summarizes these reports by sending source, is “available on all plans” for domains using Cloudflare DNS, according to Cloudflare’s docs. Microsoft points to DMARC reporting vendors in its partner catalog and doesn’t list their prices.
  • Your time. Google says DNS changes can take up to 48 hours, so plan a two-day window when you change providers.

Worked example: a 5-person shop using three senders

A store on its own domain uses Google Workspace for staff mail, Mailchimp for newsletters and Shopify for order emails, and sends about 800 messages a day to Gmail addresses.

  • It’s under Google’s 5,000-a-day line, so the minimum is SPF or DKIM. Following Google’s recommendation, it sets up all three.
  • SPF: one record covering all three senders, built from Google’s examples: v=spf1 include:_spf.google.com include:servers.mcsv.net include:shops.shopify.com ~all. That’s 3 include: tags, well under Google’s limit of 10, though each include can trigger further lookups that count toward Microsoft’s 10-lookup limit.
  • DKIM: turned on in Google Workspace, and set up for the custom domain in Mailchimp and Shopify according to their own instructions.
  • DMARC: v=DMARC1; p=none; rua=mailto:dmarc@store-domain.com, moving to quarantine once reports show all three services passing.
  • Cost of the records: $0. Cost of the mail service for 5 users: see our Workspace vs Microsoft 365 comparison, which works out 5 users × the per-user price × 12 months for each plan.

If this shop’s daily volume grows past 5,000 messages to Gmail, it’s already compliant on authentication, and only needs to confirm one-click unsubscribe in its newsletter tool.

What to watch for

  • Adding a new tool silently breaks SPF. Every new sending service means editing the one SPF record, not adding another.
  • Forwarding fails SPF. Microsoft explains that forwarding servers aren’t authorized for the original domain, so forwarded mail often fails SPF and relies on DKIM. Yahoo recommends ARC for senders who forward.
  • Strict alignment can block your own tools. adkim=s or aspf=s require exact domain matches; Google’s default is relaxed.
  • p=reject too early. Jumping straight to reject before reading reports can block real mail from a service you forgot.
  • BIMI needs enforcement. If you later want your logo shown in inboxes through BIMI, Google says the DMARC policy must be quarantine or reject with pct=100.
  • Changing email providers. SPF and DKIM values are provider-specific. Update them during a move, or mail from the new provider may fail.

Which setup fits your business?

  • Solo founder sending a few emails a day: SPF and DKIM from your email provider, plus a p=none DMARC record with a report address. It takes minutes and costs nothing.
  • Small team using several tools (shop, newsletter, CRM): all three records, one combined SPF record, DKIM on every tool, and DMARC moving to quarantine after a few weeks of clean reports.
  • Anyone sending 5,000+ messages a day to Gmail or Yahoo: all three are mandatory, with aligned From: domains, one-click unsubscribe and a spam rate under 0.3%.
  • Owners of unused or parked domains: v=spf1 -all and a reject DMARC record so nobody can send as them.

Still choosing an email host? Start at the business email hub, or see Proton Mail vs Gmail for business if privacy is the priority.

Sources