SPF, DKIM and DMARC for Small Businesses (Plain-English Setup)

If your invoices, booking confirmations or offer emails keep landing in spam, there's a good chance the problem isn't what you wrote. It's three little records on your domain that nobody set up: SPF, DKIM and DMARC.

They sound technical, and the official guides are written for IT teams. But the idea behind them is simple, and setting them up is mostly copy and paste. In this post I'll explain what each one does in plain English, what Gmail and Yahoo now expect from senders, and how to set up and check all three for your own domain.

Everything about the rules comes from Google's email sender guidelines, Google's setup guides for SPF, DKIM and DMARC, and Yahoo's sender best practices, all checked on 21 October 2026.

The 30-second version

Think of your domain (yourbrand.com) as your shop's name, and every email you send as a letter with your name on it.

• SPF is a public list of who is allowed to send letters in your name. "Our emails only come from Google Workspace and Brevo."
• DKIM is a tamper-proof seal on each letter. The receiving server checks the seal and knows the email really came from your domain and wasn't changed on the way.
• DMARC is your instruction to the post office for letters that fail those checks: "deliver them anyway but tell me", "put them in spam", or "reject them". It also sends you reports about who's sending email in your name.

SPF and DKIM prove your emails are really yours. DMARC tells receivers what to do with fakes, and shows you what's going on.

Why small businesses should care now

Since February 2024, Gmail and Yahoo have had rules for everyone who sends email to their users. Here's the short version from both companies' pages:

You're probably nowhere near 5,000 emails a day. So why bother with all three? Three reasons:

1. Google recommends it for everyone. Its sender guidelines say that to improve delivery, you should always set up SPF, DKIM and DMARC for your domains, and that unauthenticated messages might be marked as spam or rejected.
2. It protects your name. Without these records, anyone can send an email that looks like it came from your domain, like a fake invoice to your customers. Yahoo's FAQ puts it plainly: DMARC primarily protects you from third parties forging your domain. That's a reputation problem as much as a tech problem, which is why it's part of the online reputation management routine I recommend.
3. Your important emails depend on it. Invoices, booking confirmations and the review request emails you send after a sale are useless if they land in spam.

The other half of staying out of spam is sending email people actually asked for. I cover that in the 5 emails every small business should start with.

Before you start: list everyone who sends email as you

This is the step most people skip, and it's why their setup breaks later. Grab a notepad and list every service that sends email from an address on your domain:

• Your mailbox provider (Google Workspace, Microsoft 365, or your hosting company's email)
• Your email marketing tool (Brevo, Mailchimp, MailerLite and so on)
• Your online store (Shopify, WooCommerce)
• Your website's contact form, if it sends from your domain
• Booking, invoicing or CRM tools that email customers for you

Each one needs to be covered by your SPF record and should sign with DKIM. You'll also need access to your DNS settings, which usually live wherever you bought your domain (your registrar) or at your hosting company. If a developer or agency bought the domain for you, get the login now. It's your business's domain, so the account should be in your name.

Step 1: Set up SPF

SPF is one line of text (a TXT record) that lists the servers allowed to send email for your domain. Here's the important part from Google's SPF guide: each domain can have only one SPF record. If you use several senders, they all go into that one record.

If you only send email through Google Workspace, Google's example record is:

v=spf1 include:_spf.google.com ~all

If you also use, say, Mailchimp, Google's example combines both:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

How to read it: v=spf1 says "this is an SPF record", each include: adds a sender, and ~all tells receiving servers to treat mail from anyone else as suspicious. Google recommends using ~all.

Every email tool tells you exactly what to add for its service in its domain authentication settings, so copy theirs rather than guessing.

To add it, go to your domain's DNS settings and create a TXT record with the host set to @ (your main domain) and the SPF line as the value.

The mistakes I see most:

• Two SPF records. You set one up for Google Workspace, then your email tool told you to "add an SPF record", so now there are two. Merge them into one line.
• Forgetting a sender. Google's guide says that if your third-party senders aren't in your SPF record, their messages are more likely to be marked as spam.
• Too many lookups. Google says your SPF record shouldn't include more than 10 references to other domains or servers. If you're near that, remove tools you no longer use.

Google says it can take up to 48 hours for SPF to start working.

Step 2: Turn on DKIM

DKIM adds a digital signature to every email. You don't write this record yourself. Each sending service generates it for you:

1. In your email service's settings, find the domain authentication or DKIM section and generate a key.
2. It gives you a record name (usually something like selector._domainkey, for example Google's default is google._domainkey) and a long value that starts with v=DKIM1.
3. Add that as a record in your DNS exactly as given. Some tools ask for a TXT record, others for a CNAME. Follow their instructions.
4. Go back to the service and click verify or start authentication.

A few things worth knowing:

• Every sending service needs its own DKIM key. Your Google Workspace key doesn't cover Brevo, and Brevo's doesn't cover Shopify. Unlike SPF, you can have several DKIM records, because each one has a different selector name.
• Use a 2048-bit key if you can. Gmail requires DKIM keys of at least 1024 bits and recommends 2048 if your domain provider supports it. Yahoo also asks for at least 1024 bits.
• Give it time. Google says DKIM can take up to 48 hours to start working after you add the key.

Step 3: Add DMARC (start gently)

Once SPF and DKIM are working, add DMARC. Google says SPF and DKIM should be authenticating messages for at least 48 hours before you turn on DMARC. If you skip that, your own emails can get caught.

DMARC is a TXT record with the host _dmarc (some DNS panels want the full _dmarc.yourbrand.com; Google notes that some domain hosts add the domain automatically, so check how yours displays it). A safe starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com

Here's what each part means:

• v=DMARC1 says "this is a DMARC record". Google says the v and p tags must come first.
• p=none is the policy: deliver failing emails as normal, but report them. Google recommends starting with none while you learn what's happening.
• rua=mailto:... is where reports go. Google recommends always including it, but warns that reports can arrive in high volumes, so it suggests a dedicated mailbox, a group or a third-party DMARC reporting service rather than your personal inbox.

What DMARC actually checks. A message passes DMARC if it passes SPF or DKIM and the domain that passed matches the domain in your From address. That matching is called alignment. This is why sending "from" hello@yourbrand.com through a tool that isn't set up for your domain can fail DMARC, even if the tool's own records are fine.

Tightening it later. Google's recommended rollout is to monitor reports for at least a week. If there are no issues with your outgoing mail, move to p=quarantine (failing emails go to spam) for a small percentage of mail, using the pct tag, then raise the percentage. Some businesses eventually move to p=reject. Don't rush this step. A strict policy with a forgotten sender in your SPF list means your own invoices bounce.

Step 4: Check that it's working

The easiest check uses Gmail itself:

1. Send a normal email from your domain to a Gmail address that isn't yours, like a friend's or a second account. Google's DKIM guide notes you can't verify DKIM by sending a test message to yourself.
2. Open the email in that inbox, click the three-dot More menu next to Reply, and choose Show original.
3. Look for the Authentication-Results line. You want to see SPF, DKIM and DMARC passing.

Do this for each service that sends as you: your mailbox, your email marketing tool, your store. If one fails, it's usually missing from SPF or hasn't finished its DKIM setup.

To check the records themselves, Google points to the Check MX page in its Google Admin Toolbox, and says any of the many free tools on the internet will do the job too.

What if I send from Gmail?

If your business email is something like yourbrand123@gmail.com, you can't add any of these records, because you don't own gmail.com. That's fine for one-to-one emails. But don't use a free Gmail address as the From address in an email marketing tool. Gmail's sender guidelines say not to impersonate Gmail From headers, and that Gmail is moving to a DMARC quarantine policy, which can hurt delivery for mail that pretends to come from gmail.com.

A domain costs little compared with the trust it buys, and it also helps your brand look serious. If you're building a personal brand, the same domain can host the website that helps you rank for your own name on Google.

A quick checklist

• List every service that sends email from your domain
• One SPF record that includes all of them, ending in ~all
• DKIM turned on in each sending service (2048-bit where possible)
• Wait 48 hours
• DMARC record with p=none and a reports address
• Test with Show original in Gmail for each sender
• After a week or more of clean reports, consider moving towards quarantine

A small tip for freelancers: plenty of small businesses have never set this up, and fixing it is a real, useful service you can offer alongside email marketing or website work. If you're just getting started, my guide to starting freelancing in digital marketing with no experience covers how to land those first clients.

You'll find more guides on my blog, and more about me on my home page.

FAQ

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send email for your domain. DKIM adds a digital signature that proves an email came from your domain and wasn't changed. DMARC tells receiving servers what to do with emails that fail those checks and sends you reports about who is sending email using your domain.

Do small businesses need SPF, DKIM and DMARC?

Gmail and Yahoo require every sender to set up at least SPF or DKIM, and require all three for bulk senders. Google recommends that everyone sets up SPF, DKIM and DMARC to improve delivery, and DMARC also helps stop others from sending fake emails that look like they came from your domain.

Can I have two SPF records?

No. Google's guidance is that each domain can have only one SPF record. If you use several email services, combine them into a single SPF record with one include tag for each service.

What DMARC policy should I start with?

Start with p=none and a reports address, so failing emails are still delivered while you learn what's happening. Google recommends monitoring reports for at least a week before moving to quarantine for a small percentage of mail, then increasing it gradually.

How long does it take for SPF and DKIM to work?

Google says it can take up to 48 hours for SPF or DKIM authentication to start working after you add the records. Google also recommends waiting until SPF and DKIM have been working for at least 48 hours before turning on DMARC.

How do I check if my emails pass SPF, DKIM and DMARC?

Send an email from your domain to a Gmail address that isn't yours, open it, click More next to Reply, choose Show original, and check the Authentication-Results line for SPF, DKIM and DMARC passing.

Keep reading

• Email marketing for small businesses: the 5 emails to start with (with templates)
• Online reputation management for small businesses: a weekly 30-minute routine
• How to get more Google reviews without breaking Google's rules
• How to start freelancing in digital marketing with no experience
• How to rank for your own name on Google, step by step
• See all posts on the blog
• Back to my home page