SPF and DMARC Setup
SPF lists the servers allowed to send mail for your domain; DMARC tells receivers what to do when SPF and DKIM fail and where to send reports. Publish one SPF TXT record at the root, DKIM at its selector, then DMARC at _dmarc starting with p=none. Tighten to quarantine and reject once reports show every legitimate sender passing.
For domain owners and admins in India fixing email that lands in spam or meeting Gmail and Yahoo sender requirements.
knowledge
- Read time
- 5 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What do SPF, DKIM and DMARC each do?
SPF lists the servers allowed to send mail for your domain, DKIM signs each message so receivers can verify it, and DMARC tells receivers what to do when those checks fail and where to send reports. All three are DNS TXT records; none is configured in a mail client.
| Record | Host name | Job | Example value |
|---|---|---|---|
| SPF | @ (domain root) | Authorises sending servers | v=spf1 include:_spf.google.com -all |
| DKIM | selector._domainkey | Publishes the public signing key | v=DKIM1; k=rsa; p=MIIBIjAN… |
| DMARC | _dmarc | Sets policy and reporting | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
Since 2024, Gmail and Yahoo require bulk senders to publish SPF, DKIM and a DMARC record, so even small businesses sending newsletters need all three.[3]
In what order should you set up SPF, DKIM and DMARC?
Inventory every sender, publish one SPF record, enable DKIM, then add DMARC at p=none and tighten only after the reports show every legitimate sender passing. Publishing a strict DMARC policy first is how businesses end up rejecting their own invoices.
- List all services that send as your domain: mailbox host, newsletter tool, billing system, website contact form, CRM.
- Publish a single SPF record that includes all of them.
- Enable DKIM signing at each sender and publish its public key.
- Publish DMARC with
p=noneand a reporting address. - Review aggregate reports for two to four weeks and fix any failing legitimate sender.
- Move to
p=quarantine, thenp=reject.
How do you write a valid SPF record?
Publish exactly one TXT record at the domain root that starts with v=spf1, lists every sender with include: or ip4:, and ends with ~all while testing or -all when complete. SPF allows at most ten DNS-querying mechanisms per check; exceeding it returns a permanent error.[1]
v=spf1 include:_spf.google.com include:zoho.in ip4:203.0.113.10 -all- One record only: two
v=spf1records make SPF fail; merge them. - Lookup budget:
include,a,mx,existsandredirecteach count toward the ten; nested includes count too. - Never
+all: it authorises every server on the internet. - Length: each quoted string holds up to 255 characters; long records are split into several strings in one TXT record.
How do you publish a DKIM record?
Turn on DKIM at the mail provider, copy the selector and public key it shows, and publish the key as a TXT record at selector._domainkey.yourdomain.com. The private key stays with the provider and never goes in DNS.
Google Workspace commonly uses the google selector, Plesk uses default, and cPanel enables DKIM under Email Deliverability. Choose 2048-bit keys where offered. When rotating keys or changing hosts, publish the new selector before signing switches over; a missing new selector after migration is the most common DKIM failure. Background is in what DKIM is.
How do you write a DMARC record?
Publish a TXT record at _dmarc.yourdomain.com with v=DMARC1, a policy tag p, and a rua address for daily aggregate reports. A message passes DMARC when SPF or DKIM passes and the passing domain aligns with the visible From domain.[2]
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r| Tag | Meaning | Starting value |
|---|---|---|
p | Policy for failing mail: none, quarantine or reject | none |
rua | Where aggregate XML reports are sent | A dedicated mailbox |
sp | Policy for subdomains, if different | Omit to inherit p |
adkim / aspf | Relaxed (r) or strict (s) alignment | r |
Alignment explains most surprises: a newsletter tool can pass SPF for its own domain and still fail DMARC for yours. The fix is the vendor's DKIM signing with your domain, not a weaker policy.
How do you check that SPF, DKIM and DMARC work?
Query each record from a public resolver, then send a real message to Gmail and confirm "Show original" reports SPF, DKIM and DMARC as PASS. A correct DNS answer plus a passing message is the only real proof.
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT google._domainkey.example.com
# Windows
nslookup -type=txt _dmarc.example.com 8.8.8.8In cPanel the records are edited under Domains → Zone Editor → Manage; the click path is in add a TXT record in cPanel. Some panels append the domain to the host field automatically, so enter _dmarc rather than the full name. WebJi®'s email authentication checker reads all three in one pass.
What causes SPF and DMARC failures, and how do you fix them?
Most failures come from duplicate SPF records, too many SPF lookups, a missing DKIM selector after a move, a forgotten third-party sender, or a DMARC record saved at the wrong host. Change one thing at a time and re-check.
| Symptom | Cause | Fix |
|---|---|---|
| SPF permerror | Two SPF records or more than ten lookups | Merge; remove unused includes |
| No DMARC found | Record saved at the root, not _dmarc | Move it to the _dmarc host |
| DKIM fails after changing hosts | New selector not published | Publish the new selector._domainkey record |
| Legitimate mail quarantined | Sender missing from SPF or not DKIM-signed | Find it in reports, add it, then keep the policy |
| "via" shown in Gmail | Message signed by the vendor's domain | Set up DKIM on your domain at the vendor |
For mail still landing in spam with all three passing, check sender reputation with an email blacklist check.
Where do you manage these records with WebJi® mail?
With WebJi® business email hosting or cPanel hosting, DNS is edited in the same account's Zone Editor; with Google Workspace, the admin console shows the DKIM key to publish. Business email plans start at ₹2,520 a year for five 5 GB mailboxes, before 18% GST.
Email support@webji.services (24/7, Hindi and English, average first reply under 60 minutes) with the domain and the failing record. Never send the private DKIM key; it should not leave the provider.
Sources
- IETF, RFC 7208: Sender Policy Framework (DNS lookup limit, section 4.6.4).
- IETF, RFC 7489: DMARC.
- Google, Email sender guidelines.
Frequently asked questions
Should DMARC reports go to my normal inbox?
No. Aggregate reports arrive daily as compressed XML files from many providers. Use a dedicated mailbox or a DMARC reporting service that turns them into readable summaries of which sources pass and fail.
Do subdomains need their own SPF and DMARC?
Subdomains inherit the parent's DMARC policy unless you set sp or publish a separate _dmarc record for them. SPF is not inherited, so a subdomain that sends mail needs its own SPF record.
What should a domain that never sends email publish?
Publish v=spf1 -all and v=DMARC1; p=reject so nobody can send convincing mail using that domain. This is useful for parked domains and spare brand names.
How long do DNS changes take to apply?
New records usually resolve within minutes to a few hours; changed records depend on the old TTL. Test with dig against a public resolver, and allow a day before judging DMARC reports.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.