SPF, DKIM and DMARC Explained: How to Set Them Up for Bulk Email

If your emails keep landing in spam, missing email authentication is the most common reason. SPF, DKIM and DMARC are three DNS records that prove an email really comes from your domain. Since 2024, Gmail and Yahoo have required them from bulk senders, and Microsoft’s Outlook.com introduced similar rules in 2025.

This guide explains each record in plain language and shows how to add them.

Why email authentication matters

Anyone can put your address in the “From” line of an email. Without authentication, a receiving server has no way to tell your real emails from forgeries, so it treats all of them with suspicion. Authentication fixes that:

• SPF lists which servers may send email for your domain.
• DKIM adds a digital signature that proves the email wasn’t changed and was authorised by your domain.
• DMARC ties them together: it checks that SPF or DKIM matches the From domain and tells receivers what to do if it doesn’t.

The Gmail and Yahoo bulk sender requirements

For anyone sending more than 5,000 emails a day to Gmail or Yahoo addresses, the rules include:

1. SPF and DKIM set up for your sending domain.
2. A DMARC record (a policy of p=none is enough to start), with the From domain aligned with SPF or DKIM.
3. One-click unsubscribe for marketing email, and unsubscribe requests honoured within two days.
4. A spam complaint rate below 0.3% (ideally under 0.1%).

Smaller senders still need SPF or DKIM, and everyone benefits from all three.

How to set up SPF

SPF is a single TXT record on your domain that lists the services allowed to send for it.

Example for a domain that sends through Google Workspace and Amazon SES:

Type:  TXT
Name:  @
Value: v=spf1 include:_spf.google.com include:amazonses.com ~all

• Each service gives you its own include: value; check its documentation.
• ~all (soft fail) is the usual ending. -all is stricter.
• Only one SPF record per domain. Combine every service into the same record; two SPF records break SPF.
• SPF allows at most 10 DNS lookups. If you use many services, remove ones you no longer use.

How to set up DKIM

DKIM uses a key pair: your email provider signs each email with a private key, and you publish the public key in DNS.

1. In your provider’s admin area, find DKIM (Google Admin console: Apps → Google Workspace → Gmail → Authenticate email). Generate a key.
2. The provider shows a record name (the selector, for example google._domainkey) and a long value starting with v=DKIM1.
3. Add it as a TXT (or CNAME, for some providers) record in your DNS.
4. Go back to the provider and click Start authentication or Verify.

Each sending service has its own DKIM record, so set up DKIM separately for Google Workspace, Amazon SES, Brevo, and so on.

How to set up DMARC

DMARC is a TXT record at _dmarc.yourdomain.com.

Starter record:

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• p=none only monitors: nothing is blocked, but you start receiving reports at the rua address.
• After a few weeks, when all your legitimate senders pass, change to p=quarantine (failures go to spam) and later p=reject (failures are refused).
• DMARC reports are XML files. A free DMARC report viewer makes them readable.

How to check your records

• Send a test email to a Gmail address you own, open it, click ⋮ → Show original and check that SPF, DKIM and DMARC all say PASS.
• Use an online SPF, DKIM or DMARC checker to look for syntax errors.
• In HAAN MAIL PRO, use Send Test before every campaign and check the result in a real inbox.

Where to add these records

Add them where your domain’s DNS is managed, usually your domain registrar or a service like Cloudflare. Look for DNS, DNS records or Zone editor, then Add record. Changes usually work within an hour.

Common mistakes

• Two SPF records: merge them into one.
• Forgetting a service: every service that sends as your domain (CRM, help desk, SMTP relay) must be in SPF and have DKIM set up.
• Jumping straight to p=reject: start with p=none, read the reports, then tighten.
• Sending from a free address with your own name: you can’t add DNS records to gmail.com, so use your own domain for business email.

Next steps

Authentication is the foundation. Add a gradual warm-up (see how to warm up an email account) and good sending habits (why emails go to spam and how to fix it), and your campaigns will have the best chance of reaching the inbox.