Email Authentication Setup Guide

TL;DR: To fully authenticate your domain's email you need three DNS records: an SPF record that lists your authorised senders, a DKIM key pair that signs outgoing mail, and a DMARC record that tells receivers what to do when either check fails. Set them up in that order — SPF first, DKIM second, DMARC last. Run a free Kalenfy scan before you start to see which are missing or broken on your domain right now.

Why you need all three — not just one

SPF, DKIM and DMARC work as a chain. SPF alone can be bypassed because it doesn't protect the visible From address. DKIM alone proves the message body wasn't altered but doesn't stop a spoofed From domain. DMARC ties them together: it requires SPF or DKIM to both pass and align with the From domain — and it lets you instruct receivers to reject mail that fails both. Without DMARC, anyone can send email as your domain.

Since February 2024, Google and Yahoo require all bulk senders to have SPF, DKIM and DMARC in place or risk rejection. Even for non-bulk senders, all three are now effectively table stakes for reliable delivery.

Step 1 — Set up SPF

SPF is a TXT record on your domain that lists the mail servers allowed to send on your behalf. Add it to your DNS as a TXT record on the root domain (@).

Common starting points:

Combine all your senders into one SPF record — having two SPF records on the same domain breaks SPF. A record covering Google Workspace and Mailchimp looks like:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

End with ~all (softfail) while testing; switch to -all (hardfail) once you're confident all legitimate senders are included. Stay under 10 DNS lookups.

Step 2 — Enable DKIM

DKIM requires your email provider to generate a key pair. The private key signs outgoing messages; you publish the public key in your DNS. Enable it in your email platform first, then add the DNS record it gives you.

• Google Workspace: Admin console → Apps → Gmail → Authenticate email → Generate new record. Copy the TXT value and add it to DNS at the selector it shows (e.g. google._domainkey.yourdomain.com).
• Microsoft 365: Security portal → Email & collaboration → Policies → DKIM → select your domain → Enable. Add the two CNAME records it shows to DNS.
• Third-party ESPs (Mailchimp, SendGrid, etc.): look for "Authenticate domain", "Custom DKIM domain" or "Domain authentication" in account settings. Each provides CNAME or TXT records to add.

After adding the record, allow 15–60 minutes for DNS propagation, then verify with a free Kalenfy scan or by sending a test email to a Gmail address and checking the raw headers for dkim=pass.

Step 3 — Add DMARC

Once SPF and DKIM are passing, add your DMARC record. This is a TXT record at _dmarc.yourdomain.com. Start with p=none (monitor only) and an aggregate report address so you can see what's authenticating before enforcing.

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r

After two to four weeks, review the reports. If only legitimate mail is appearing, step up to p=quarantine (spam folder) and then p=reject (block):

The full journey from p=none to p=reject is covered in DMARC p=none vs p=reject.

Step 4 — Verify everything is working

1. Send a test email from your domain to a Gmail address.
2. Open the message → ⋮ → Show original.
3. In Authentication-Results, confirm: spf=pass, dkim=pass, dmarc=pass.
4. Or scan your domain at Kalenfy — the report checks all three live and shows your overall grade.

Common mistakes to avoid

• Two SPF records. Only one v=spf1 TXT record is allowed per domain. Merge everything into one.
• Adding DMARC before DKIM is enabled. If DKIM isn't signing yet, DMARC will always fail one check. Enable DKIM first, verify it passes, then add DMARC.
• Setting p=reject too fast. If you have senders you forgot to include, p=reject will block their mail. Start at p=none, read the reports, then escalate.
• Forgetting parked domains. Any domain you own but don't send email from should have a locked-down DMARC record — otherwise attackers can spoof those domains too.

FAQ

Does the order (SPF → DKIM → DMARC) matter?

Yes. DMARC references SPF and DKIM results — if either doesn't exist, DMARC will immediately fail on that check. Set up SPF and DKIM first, verify both pass, then add DMARC. Adding DMARC first with p=none is harmless but generates fail reports until the other two are in place.

How long does setup take?

For a single-provider domain (e.g. only Google Workspace), an experienced person can complete all three records in 20–30 minutes. DNS propagation adds 15 minutes to 2 hours. Multi-provider setups (several ESPs, CRMs, transactional tools) take longer to inventory all senders before writing the SPF record.

Do I need email authentication if I use Google Workspace?

Google Workspace enables DKIM for you once you add the DNS record, and suggests SPF. DMARC is not automatic — you must add it yourself. Without DMARC, even with SPF and DKIM passing, your domain can still be spoofed in the From display.

What if I don't send any email from my domain?

You still need SPF and DMARC to prevent spoofing. Use v=spf1 -all (no authorised senders) and v=DMARC1; p=reject; (block everything) on parked domains.