SPF, DKIM & DMARC — Complete Email Configuration Guide for 2026

By Tibzi Team — 2026-03-03T14:47:19.148Z

If your emails often land in spam, or you want to protect your domain against phishing, you need to set up SPF, DKIM and DMARC correctly. These 3 protocols work together to authenticate the emails sent on behalf of your domain.

This guide walks you through the setup step by step, with specific instructions for the most popular platforms in Romania.

What SPF, DKIM and DMARC are — explained simply

SPF (Sender Policy Framework)

SPF is like a guest list for email. You publish a DNS record that says: "Only these servers are allowed to send email from my domain." When someone receives an email from you, the recipient's server checks whether the sending server is on your list.

DKIM (DomainKeys Identified Mail)

DKIM is like a signature and seal on every email. Your server adds a cryptographic signature to every email it sends. The recipient can verify the signature using the public key in your DNS. If the email was altered along the way, the signature becomes invalid.

DMARC (Domain-based Message Authentication)

DMARC is the policy that ties SPF and DKIM together. It tells receiving servers: "If an email from me passes neither SPF nor DKIM, here's what to do with it" (accept it, send it to spam, or reject it outright).

Why you need all 3

  • SPF only → partial protection, but forwarded emails fail SPF
  • SPF + DKIM → good protection, but no enforcement policy
  • SPF + DKIM + DMARC → full protection + reports on spoofing attempts

Google and Yahoo made SPF + DKIM + DMARC mandatory in February 2024 for senders who send more than 5,000 emails/day. Without them, your emails can be rejected outright.

Setting up SPF — step by step

Step 1: Identify the servers that send email

Before you create your SPF record, list ALL the services that send email from your domain:

  • Your main email server (Google Workspace, Microsoft 365, cPanel, etc.)
  • Newsletter services (Mailchimp, SendGrid, Brevo, etc.)
  • CRMs that send email (HubSpot, Salesforce, etc.)
  • Your web server (if it sends transactional emails)

Step 2: Create the SPF record

Add a TXT DNS record on your main domain (not on a subdomain):

# Google Workspace
v=spf1 include:_spf.google.com ~all

# Microsoft 365
v=spf1 include:spf.protection.outlook.com ~all

# cPanel (hosting server)
v=spf1 +a +mx include:_spf.google.com ~all

# Multiple services (example)
v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all

Important SPF rules:

  • Only one SPF record per domain. If you use several services, combine them into a single record.
  • ~all (soft fail) is recommended to start with. -all (hard fail) is stricter but can cause problems if you've forgotten a service.
  • Maximum 10 DNS lookups — every include: counts. Too many includes will cause errors.

Setting up DKIM — step by step

Google Workspace

  1. Go to the Admin Console → Apps → Google Workspace → Gmail
  2. Click Authenticate Email
  3. Select your domain and click Generate new record
  4. Copy the generated DKIM record and add it as a TXT record in your DNS
  5. Wait for DNS propagation (up to 48 hours), then click Start Authentication

Microsoft 365

  1. Go to the Microsoft 365 Admin Center → Settings → Domains
  2. Select your domain → DNS Records
  3. Add the 2 CNAME records generated by Microsoft to your DNS
  4. Go to the Exchange Admin Center → Mail Flow → DKIM
  5. Select your domain and enable DKIM

cPanel

  1. Go to cPanel → Email Deliverability
  2. Find your domain and click Manage
  3. If DKIM isn't active, click Install the suggested record
  4. If your DNS is hosted externally (e.g. Cloudflare), copy the record and add it manually

Setting up DMARC — step by step

Step 1: Start with monitoring (p=none)

Add a TXT record on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1

This says: "Don't do anything with emails that fail, but send me reports." Wait 2-4 weeks and analyze the reports to make sure all your legitimate email passes SPF/DKIM.

Step 2: Move to quarantine

Once you've confirmed that all your legitimate email is authenticated:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Emails that fail SPF and DKIM will land in the recipients' spam folder.

Step 3: Move to reject (maximum protection)

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Unauthenticated emails are rejected outright. This gives you maximum protection against phishing, but you need to be sure that all your legitimate email passes the checks.

Checking and troubleshooting

Once everything is set up, check it with our free email checker. It analyzes SPF, DKIM, DMARC, MTA-STS, BIMI and MX records, with plain-language explanations.

Common problems:

  • SPF: too many DNS lookups — fix: use direct IPs instead of includes where possible, or flatten the record with an SPF flattener tool
  • DKIM: key not found — fix: check the DKIM selector. Google uses "google", Microsoft uses "selector1" and "selector2"
  • DMARC: alignment failure — fix: make sure the domain in From: matches the SPF/DKIM domain (alignment)
  • Slow DNS propagation — it can take up to 48 hours. Check back periodically.

MTA-STS and BIMI — the next level

MTA-STS (Mail Transfer Agent Strict Transport Security)

Enforces TLS encryption for email received by your domain. It prevents man-in-the-middle attacks on email in transit. It requires: a TXT DNS record on _mta-sts.yourdomain.com + a /.well-known/mta-sts.txt file on your server.

BIMI (Brand Indicators for Message Identification)

Displays your company logo in recipients' inboxes (Gmail, Yahoo, Apple Mail). It requires: DMARC with p=quarantine or p=reject, an SVG Tiny PS logo, and optionally a VMC (Verified Mark Certificate).

Our tool checks MTA-STS and BIMI too.

Conclusion

SPF, DKIM and DMARC are no longer optional — they are essential for deliverability, protection against phishing and compliance with Google/Yahoo requirements. Setting them up correctly takes less than an hour and protects your domain for the long term.

Check your current setup with our free tool, and if you need a full audit, run a free 27-module audit.