In short
- SPF authorises your sending servers.
- DKIM signs your messages with a published public key.
- DMARC sets policy and reporting, and requires alignment.
- Verify with live DNS lookups, not with your provider's dashboard alone.
The order to do this in
- Decide the exact domain or subdomain you will send from.
- Publish SPF for that domain, authorising your SMTP provider.
- Enable DKIM signing at your SMTP provider and publish the public key it gives you.
- Publish DMARC at p=none with a reporting address.
- Send a test message and verify SPF and DKIM pass and align.
- Raise DMARC to quarantine, then reject, once reports are clean.
What alignment means
DMARC passes when SPF or DKIM passes and the domain it passed for matches the domain in your visible From address. A common failure is passing SPF for your provider's domain while sending From your own — technically valid SPF, failed DMARC alignment.
Records at a glance
SPF (TXT at yourdomain.com)
v=spf1 include:your-smtp-provider.com -allDKIM (TXT at selector._domainkey.yourdomain.com)
v=DKIM1; k=rsa; p=MIGfMA0GCSq... (public key from your provider)DMARC (TXT at _dmarc.yourdomain.com)
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=sUsing a subdomain for campaigns
Sending campaigns from mail.yourdomain.com or news.yourdomain.com keeps marketing reputation separate from your business email. Each subdomain needs its own SPF and DKIM records; DMARC at the organisational domain applies unless you publish a subdomain policy.
Checklist
- One SPF record only, authorising the real sender.
- DKIM public key published at the correct selector.
- DMARC record published with a reporting address.
- From domain aligns with a passing SPF or DKIM check.
- Records verified with a live DNS lookup.
Run these checks now
Questions people ask
Can I have two SPF records?
No. A domain must publish exactly one SPF TXT record. Merge multiple includes into a single record instead.
How long do DNS changes take?
Usually minutes to a few hours, depending on the previous record's TTL. Re-test rather than assuming.
Do I need DMARC if SPF and DKIM pass?
Yes. DMARC adds alignment enforcement and reporting, and major providers increasingly expect it for bulk senders.