How to Set Up SPF, DKIM and DMARC: A Step-by-Step Guide for Small Businesses

If your company domain has no email authentication, anyone on the internet can send a message that appears to come from billing@yourcompany.com — and many inboxes will deliver it. That is how fake invoices, payroll-change requests and “please update our bank details” emails reach your customers and suppliers with your name on them.

Three free DNS records — SPF, DKIM and DMARC — close that gap. This guide explains what each one does, shows the exact records to publish for Google Workspace and Microsoft 365, and walks through a safe rollout that will not block your own legitimate mail. Most small businesses can finish it in a few weeks, with about an hour of hands-on work.

Not sure where your domain stands? Our free website and email security check shows in seconds whether SPF and DMARC are set up.

Why email authentication matters for a small business

Email spoofing is not a problem only for banks and big brands. Small businesses are attractive precisely because they rarely protect their domains, and because their customers trust an email that looks like it comes from a supplier they already pay. A single convincing fake invoice can cost more than years of IT budget.

There is also a deliverability reason. Since 2024 Google and Yahoo require senders of bulk mail to have SPF, DKIM and DMARC in place, and Microsoft introduced similar rules for Outlook.com in 2025. Even if you only send a modest newsletter, missing authentication increasingly means your genuine messages land in spam.

SPF, DKIM and DMARC in plain English

• SPF (Sender Policy Framework) — a public list of the servers allowed to send mail for your domain: your email provider, your newsletter tool, your invoicing system. Receivers compare the sending server against that list.
• DKIM (DomainKeys Identified Mail) — a cryptographic signature your provider adds to every outgoing message. Receivers check it against a public key in your DNS, so a forged or altered message fails.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) — the policy that ties SPF and DKIM to the address people actually see in the “From” line, tells receivers what to do with mail that fails, and sends you reports about who is sending in your name.

The key idea is alignment. SPF and DKIM on their own can pass for a criminal’s own domain while the visible From address still says yours. DMARC only passes when SPF or DKIM passes and the domain they verified matches the From domain. That is what finally makes spoofing your exact domain fail.

“Without DMARC, your domain is a letterhead anyone can print. With it, the forgeries go to spam or nowhere at all.”

NyorsoftExternal Security Review

Before you start: list everything that sends email as you

The most common way to break your own email is to forget a service. Before touching DNS, write down every system that sends mail using your domain. Typical examples:

• Your main mailbox provider (Google Workspace, Microsoft 365, Zoho, your web host)
• Newsletter and marketing tools (Mailchimp, Brevo, HubSpot, Klaviyo)
• Invoicing, accounting and CRM systems that email customers
• Your website’s contact form or online shop notifications
• Help-desk and booking tools

Do not worry if the list is incomplete — the DMARC reports in step 3 will reveal anything you missed. That is exactly why the rollout starts in monitoring mode.

Step 1: Publish one correct SPF record

SPF is a TXT record on your root domain. It starts with v=spf1, lists the allowed senders, and ends with a rule for everything else.

For Google Workspace:

Type: TXT   Host: @
v=spf1 include:_spf.google.com ~all

For Microsoft 365:

Type: TXT   Host: @
v=spf1 include:spf.protection.outlook.com ~all

Add an include: for each additional service, using the value from that service’s help pages — for example v=spf1 include:_spf.google.com include:servers.mcsv.net ~all if you also use Mailchimp.

Three rules that trip people up:

• Only one SPF record per domain. Two separate v=spf1 records make SPF fail entirely. Merge them into one.
• Stay under 10 DNS lookups. Every include counts, and so do the includes inside it. Go over the limit and SPF returns an error. If you are close, remove services you no longer use.
• Start with ~all (soft fail). You can tighten to -all later, but DMARC does the real enforcement, so ~all is perfectly fine long-term.

Step 2: Turn on DKIM signing

DKIM is enabled inside your email provider, which then gives you the DNS record to publish.

Google Workspace: in the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, generate a new record with a 2048-bit key, publish the TXT record it shows (host google._domainkey) at your DNS provider, wait for it to propagate, then click Start authentication.

Microsoft 365: in the Microsoft Defender portal open Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, select your domain, publish the two CNAME records it lists (selector1._domainkey and selector2._domainkey), then enable signing.

Repeat for every other service on your list. Most newsletter and CRM tools have a “domain authentication” page that gives you one or two DKIM records to add. Services that sign with DKIM using your domain will pass DMARC even when SPF does not align — which makes DKIM the more robust of the two.

Step 3: Publish DMARC in monitoring mode

DMARC is a TXT record on the _dmarc subdomain. Start with a policy of none, which changes nothing about delivery but turns on reporting:

Type: TXT   Host: _dmarc
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com

The rua address receives daily aggregate reports from Gmail, Outlook, Yahoo and other providers. They are XML files that are hard to read by hand, so point them to a dedicated mailbox and use a free DMARC report viewer to turn them into a readable list of sending sources.

Leave this in place for two to four weeks. In the reports, look for:

• Legitimate services failing — a forgotten invoicing tool or contact form. Fix them by adding SPF includes or enabling DKIM for that service.
• Unknown sources passing nothing — usually spoofing attempts. These are what DMARC enforcement will block.

Step 4: Move to quarantine, then reject

When every legitimate source passes, tighten the policy. A cautious path:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@yourcompany.com
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com

p=quarantine sends failing mail to spam; pct=25 applies it to a quarter of failing messages while you watch for surprises. p=reject tells receivers to refuse spoofed mail outright. Keep reading the reports for a week or two at each stage. For most small businesses the whole journey from none to reject takes four to eight weeks.

Protect the domains you do not send email from

Attackers love parked domains, old brand names and typo-variants you registered and forgot, because nobody watches them. If a domain never sends mail, lock it down completely:

TXT  @        v=spf1 -all
TXT  _dmarc   v=DMARC1; p=reject;
MX   @        0 .

The last line is a “null MX” record that states the domain does not accept email at all.

How to check your records

You can look up any of these records from a terminal:

nslookup -type=txt yourcompany.com
nslookup -type=txt _dmarc.yourcompany.com
nslookup -type=txt google._domainkey.yourcompany.com

Free online checkers will also validate the syntax and count your SPF lookups. The real test, though, is sending a message to a Gmail account and choosing Show original: you want to see SPF: PASS, DKIM: PASS and DMARC: PASS.

Common mistakes to avoid

• Publishing two SPF records instead of merging them into one.
• Jumping straight to p=reject without a monitoring period, and blocking your own invoices.
• Setting up DMARC with no rua address, so you never see what is happening.
• Enabling DKIM for your mailbox but not for your newsletter or CRM tools.
• Leaving DMARC at p=none forever. Monitoring is a step, not the destination — p=none does not stop a single spoofed email.

Need a second pair of eyes?

Email authentication is one of the first things we check in a Public Website Security Check, alongside your website’s TLS, security headers and exposed services. If you would rather have someone confirm your SPF, DKIM and DMARC are set up correctly — or find the forgotten service before you switch to reject — take a look at our pricing or get in touch.

Sources and further reading

• IETF RFC 7489: DMARC – the DMARC specification.
• Google: Email sender guidelines – Gmail’s authentication requirements for senders.
• Yahoo: Sender best practices – Yahoo’s requirements for bulk senders.
• Microsoft: Outlook’s new requirements for high-volume senders – SPF, DKIM and DMARC rules for Outlook.com.
• Google Workspace: Set up DMARC – step-by-step DMARC setup for Google Workspace domains.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team