Guides · Email and domains
SPF, DKIM and DMARC: Three Settings That Keep Your Email Out of Spam
By Josh Croom · October 27, 2026 · 11 min read
SPF, DKIM and DMARC are three rows in your domain's settings that prove your email really comes from you. Gmail, Yahoo and Outlook all check them, so set up all three for each tool that sends mail in your name, and then test each tool with one email.
The year-end email that nobody saw
December 31, 9:05 AM. A small nonprofit sends the biggest email of its year to everyone on its list. By lunch, the director has a text from a longtime donor who found the letter in her spam folder, right under an offer for a car warranty.
Nobody on staff had changed a thing, and the letter went to the same list it always had. Gmail and Yahoo had changed instead: in 2024 they began requiring proof of who sent each message, and a big send to a long list gets their strictest check.
The cause can be as small as one newsletter tool that was never allowed to send for the domain. Every message that tool sends then fails the check, and nobody on staff sees a warning.
Found your year-end letter in my spam folder today. Is that really from you?
It is, and thank you for telling us! We're fixing our email settings this morning.
What SPF, DKIM and DMARC each do
All three rows live in your domain's DNS, the same list that points your web address at your website. Think of your email as a letter that has to get past a guard at the door.
SPF is the guest list. It names every service that may send mail with your domain on it, like your email system, your newsletter tool and the system that sends your receipts. When a message shows up from a service that isn't on the list, the guard gets suspicious.
DKIM is the wax seal. Your email tool signs each message with a private key, and your DNS holds the public half, so the inbox can check the seal. If anyone changes the message on the way, the seal breaks and the check fails.
DMARC is the guard's orders. It tells the inbox what to do with a message that fails, and it asks the inbox to send you reports. Those reports list the services that sent mail as you, so you can find the tools you forgot about.
| Row | What it does | What it looks like |
|---|---|---|
| SPF | Lists the services allowed to send mail as you. | v=spf1 include:(your email system) include:(your newsletter tool) ~all |
| DKIM | Signs each email, so the inbox can tell nobody changed it. | A long public key that your email tool gives you, saved under a name it picks |
| DMARC | Tells the inbox what to do when a message fails, and sends you reports. | v=DMARC1; p=none; rua=mailto:(an address for reports) |
Why Gmail, Yahoo and Outlook care now
The big inboxes turned these rows from good advice into rules in 2024, and Outlook now has rules of its own.
- 5,000messages a day to Gmail makes you a bulk senderand bulk senders need all three rows
- 0.3%the spam rate Gmail's rules say to stay underand Google suggests staying under 0.1%
- 10DNS lookups one SPF row may usego past it and SPF fails
Since February 2024, Gmail has required anyone who sends 5,000 or more messages a day to Gmail addresses to pass SPF, DKIM and DMARC. Those senders also need a one-click unsubscribe link, and they have to keep spam reports under 0.3%. Every sender to Gmail, even a small one, needs SPF or DKIM at the very least.
Yahoo announced the same kind of rules that same week. Microsoft now holds Outlook.com, Hotmail and Live addresses to a similar bar. A domain that sends 5,000 or more messages to those inboxes needs SPF and DKIM passing and a DMARC row, or Outlook turns the mail away with an error.
You may never send 5,000 emails on a normal day. One big send to a long list can still put you in the strictest group, and a year-end appeal or a holiday sale is exactly that kind of send. Setting up all three rows ahead of time means you never have to guess which group you're in.
How to set up SPF, DKIM and DMARC
Do these steps in order, because each one depends on the one before it. Whoever runs your email system usually handles the DNS part, and most steps take minutes once you know where the settings live.
Step 1
List every tool that sends email as you
Write down your email system, your newsletter tool, the system that sends receipts, your booking tool and your website's forms. A tool you forget is the one that fails, because nobody ever added it to the guest list.
Step 2
Send one test email from each tool
Send each test to a Gmail address and open it on a computer. Click the three dots next to Reply, choose Show original, and look for SPF, DKIM and DMARC, which should each say PASS.
Step 3
Fix a FAIL inside the tool that sent it
Each tool has a settings page, often called domain authentication, that gives you the exact rows it needs. Add them where your DNS lives, word for word, because one wrong character breaks the check.
Step 4
Keep one SPF row
When a new tool hands you an SPF row, add its include part to the row you already have. Two SPF rows break both of them, so SPF fails for every message, even from the tools you set up right.
Step 5
Add DMARC last, set to watch
Start with p=none and an address for reports. This setting doesn't change where your mail goes, so it's safe to add, and the reports show you every tool that sends as you.
Step 6
Clean your list before a big send
Send only to people who asked to hear from you, and remove the addresses that bounce. Put a one-click unsubscribe link in every newsletter, because an easy way out keeps spam reports low.
Step 7
Test again after any change
Every time a tool, a host or a setting changes, send an email to and from your address and check Show original one more time. It takes two minutes and catches problems before your list does.
Where to read the results in Gmail
Gmail shows the check on any message you open on a computer. Open your test email, click the three dots next to Reply, and choose Show original. A new window opens with a short summary at the top, and three lines in it matter most.
Don't read a missing line as a pass. If one of the three lines isn't there, ask whoever runs your email whether that row exists, and add a DMARC row set to p=none if your domain doesn't have one yet.
| Line | What PASS means | What to do on FAIL |
|---|---|---|
| SPF | The server that sent it is on your guest list. | Add the tool's include to your one SPF row. |
| DKIM | The message carries your signature, and nobody changed it. | Turn on domain authentication in the tool that sent it, and add its rows. |
| DMARC | SPF or DKIM passed and matched your domain. | Fix SPF or DKIM first. DMARC passes once one of them passes and matches your domain. |
What breaks email, and what keeps it flowing
Most email trouble comes from the same few setup habits, and each has a simple fix.
What breaks it
- A second SPF row added for a new tool.
- DMARC set to p=reject on the first day.
- Newsletters sent from a personal Gmail or Yahoo address.
- A new tool turned on with no test email.
What keeps it flowing
- One SPF row, with each tool's part added to it.
- DMARC at p=none until every tool passes.
- Every email sent from an address on your own domain.
- A test from each tool, checked in Show original.
Which DMARC setting to use, and when
DMARC has three settings, and the safe path moves through them in order. The setting is the p= part of the row.
If you jump to p=reject before every tool passes, the inbox can turn away real mail from any tool that isn't passing yet, like receipts and password resets, along with the fakes. Starting at p=none costs you nothing, because mail flows the way it did before, and the reports tell you what still needs work.
Give the reports a few weeks before you change anything. Move up one step when every service you use shows up passing and the only failures come from senders you don't recognize.
| Setting | What the inbox does with a failing message | When to use it |
|---|---|---|
| p=none | Nothing special. It delivers as usual and sends you reports. | Start here, while you find and fix every tool. |
| p=quarantine | Treats it as suspicious, which usually means the spam folder. | After your reports show every tool passing. |
| p=reject | Turns it away, so it never arrives. | Once quarantine runs with no surprises. |
The SPF limit most people miss
Each tool you add to your SPF row usually adds an include, and each include makes the inbox look up another record. The SPF standard caps those lookups at 10 for one check, and going past 10 makes SPF fail for every message, even the ones from your main email system.
You can hit this limit after years of adding tools and never removing one. The fix is to take out tools you no longer use, and to ask whoever runs your email whether a newer tool can pass with DKIM instead. DMARC only needs one of the two, SPF or DKIM, to pass and match your domain.
Your website and your email share one list
These rows sit in the same DNS list as your website's rows. That's why a website move can break email when someone deletes or replaces rows they didn't recognize. Before anyone edits your DNS, save a copy of every row, so you can put back anything that goes missing in minutes.
When we move a website, our checklist leaves every mail row just as it was and tests email both ways afterward. If no DMARC row exists yet, it adds one set to p=none once mail is working. You can read more about how we build and launch sites on our web development page.
Your contact forms depend on these rows too, because an alert email tells you each time someone fills out a form on your site. When that alert lands in spam, nobody calls the lead back. Our speed to lead guide covers what happens when a new inquiry waits, and the first fix is making sure the alert arrives.
Check your email setup
Answer five quick questions about your setup, and your answers stay on your device.
Can you name every tool that sends email with your domain on it?
Does a test email from each tool show PASS for SPF, DKIM and DMARC?
Does your domain have exactly one SPF row?
Do you have a DMARC row, even one set to p=none?
Does every newsletter carry a one-click unsubscribe link?
Your setup is in good shape, so keep testing after every change and read your DMARC reports before you move to a stricter setting.
You're close, so fix the first question you answered No and then send a fresh test from every tool before your next big email.
Start with Step 1 this week, because a list of your sending tools makes every other fix faster. Then test each tool in Show original.
Before your next big send
Tick each one off as you go, and your ticks stay on this device.
0 of 8 done
Talk it through with us
We've run Google Ads for nonprofits, churches and local businesses since May 2016, and every website we move gets its email tested both ways. If a new website or a Google Ads plan is on your list this year, book a call with Miguel. He'll ask what you're working toward and tell you where he'd start.
Questions people ask
What is the difference between SPF, DKIM and DMARC?
SPF lists the services allowed to send email for your domain. DKIM signs each message so the inbox can tell nobody changed it. DMARC tells the inbox what to do when a message fails those checks, and it sends you reports about who is sending as you.
Do I need DMARC if I'm a small business?
Gmail requires DMARC for anyone who sends 5,000 or more messages a day to Gmail addresses, and every sender needs SPF or DKIM. A DMARC row set to p=none doesn't change where your mail goes, and its reports show you every tool sending as you, so it's worth adding at any size.
Can I have two SPF records?
No, because the SPF standard says a domain must not have more than one SPF record, and two rows make both fail. Add each new tool's include to the one row you already have.
What DMARC policy should I start with?
Start with p=none and an address for reports. Move to p=quarantine once the reports show every tool passing, and to p=reject only after quarantine runs with no surprises.
How do I check if my SPF, DKIM and DMARC are working?
Send a test email to a Gmail address and open it on a computer. Click the three dots next to Reply, choose Show original, and look for PASS next to SPF, DKIM and DMARC. Repeat it for every tool that sends as you.
See how we build and move websites without breaking email
Read next
- Call Log Template: What to Write Down From Every CallA ready-to-copy call log, the one question to ask every caller, and how to sort wrong numbers.
- ChatGPT Custom Instructions Examples: Make Each Fix Only OnceEight custom instructions examples to copy, and a four-line card that carries your fixes into every chat.
- ChatGPT Prompt Templates: Write the Weekly Ask Once and Save ItCopy-ready ChatGPT prompt templates for the jobs you run every week, and how to save each one.