How to Set Up SPF, DKIM and DMARC for Small Business Email

To set up SPF, DKIM and DMARC, add three DNS records to your domain. SPF lists the services allowed to send your email. DKIM adds a digital signature your email provider generates. DMARC tells other mail servers what to do with messages that fail those checks. Start DMARC at "none," then tighten it over a few weeks.

Email authentication used to be a job for large companies with an IT team. That changed when Gmail began requiring authentication for every sender in February 2024. Small businesses without SPF, DKIM and DMARC now see invoices land in spam and, worse, scammers sending fake invoices from their domain.

This setup guide is for owners and office managers at small businesses that use Google Workspace, Microsoft 365 or a similar provider, plus a tool or two for newsletters and invoices. It walks through each record in order, what to type, what tends to go wrong and how to know you are done.

Why SPF, DKIM and DMARC Matter for a Small Business

The first reason is fraud. The Federal Trade Commission (FTC) warns in its cybersecurity guidance for small businesses that, without protections, scammers can use your domain name to send phishing emails. With authentication in place, those imposter emails are blocked or sent to quarantine instead.

The second reason is delivery. Google's email sender guidelines require every sender to Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages a day must use all three, align the From address with SPF or DKIM and keep spam rates below 0.30%. Microsoft announced similar rules for high-volume senders to Outlook.com in 2025.

Most small businesses never reach 5,000 messages a day. A newsletter tool or invoicing app sending on your behalf can push you closer than you think, though. Setting up all three records now costs an hour and removes the question entirely.

Before You Start: List Every Service That Sends as Your Domain

Every service that sends email with your domain in the From address has to be listed in SPF and set up for DKIM. Missing one is the most common reason a new setup sends real email to spam. Write the list before you touch DNS.

Check these common senders for a small business.

You will also need a login for your DNS host, which is usually your domain registrar or web host. That login controls your email, website and more, so store it in a shared password vault. Our 1Password vs. Bitwarden comparison covers two good options for a small team.

Step 1: Publish One SPF Record

SPF, short for Sender Policy Framework, is a DNS TXT record that lists the servers allowed to send mail for your domain. It sits at the root of the domain and starts with "v=spf1." Each sending service gives you an "include" value to add.

Follow these steps to publish it.

Two SPF records on one domain is the classic mistake. Receiving servers treat that as an error, and SPF fails for everything. If a new tool tells you to "add an SPF record," merge its include into the existing one instead.

SPF also has a limit of 10 DNS lookups. A business using six or seven sending tools can hit it. If you do, drop tools you no longer use first, then ask the remaining vendors whether they rely on DKIM alone.

Step 2: Turn On DKIM Signing for Each Sender

DKIM, short for DomainKeys Identified Mail, adds a digital signature to each outgoing message. The receiving server checks the signature against a public key published in your DNS. If the message was changed or forged, the check fails.

You do not write the DKIM key yourself. Each sending service generates it in its admin settings and gives you a TXT or CNAME record to publish. Google's guidelines call for a key of at least 1,024 bits and recommend 2,048.

The step people skip is the last one. After the DNS record is live, you usually have to return to the service and switch signing on. Until you do, nothing is signed, even though the record looks correct.

Step 3: Add a DMARC Record and Tighten It Slowly

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, ties SPF and DKIM to the From address people see. It also tells receivers what to do when a message fails. The DMARC.org overview describes three policy options: none, quarantine and reject.

The record goes at _dmarc.yourdomain.com as a TXT record. A safe first version reads v=DMARC1; p=none; rua=mailto: followed by an address you check. The rua address receives daily reports on which servers sent mail as your domain and whether it passed.

Plan the rollout in stages over four to eight weeks.

The raw reports are XML files that are hard to read. A free or low-cost DMARC report viewer turns them into a simple list of senders. Check it weekly during the rollout.

Subdomains need a thought too. By default, the DMARC policy on your main domain also covers subdomains such as mail.yourdomain.com. If a tool sends from a subdomain, include it in your sender list and test it before you reach reject.

How Do You Protect Domains That Never Send Email?

Publish an SPF record of v=spf1 -all and a DMARC record with p=reject on every domain that never sends mail. Spare domains, old brand names and typo domains are easy targets for spoofing. These two records tell receiving servers that any email claiming to come from them is fake.

That approach comes from federal practice. The Cybersecurity and Infrastructure Security Agency (CISA) directive BOD 18-01 required federal agencies to reach a DMARC reject policy and to use the "v=spf1 -all" null record on domains that do not send mail. The same records cost a small business nothing.

If you verified domain ownership for other tools, those TXT records can stay. Search tools often use the same DNS panel, as our comparison of Google Search Console and paid SEO tools explains. Only the SPF record has the one-per-domain rule.

Common Setup Mistakes and How to Fix Them

Most failed setups trace back to a short list of errors. These are the ones worth checking first when mail starts landing in spam.

Each fix is small once you find the cause. The DMARC reports usually point straight at it, because they name the server that failed and the check it missed.

How to Check Your Setup Is Working

Testing takes ten minutes. Send a message from each service to a personal Gmail account, open it and choose "Show original." Gmail lists SPF, DKIM and DMARC results for that message as pass or fail.

Repeat the test after each change and after you add any new tool. At Little iApps, we treat "who sends as us" as part of every software rollout checklist. A new invoicing or CRM tool is not finished until its mail passes all three checks.

Your mailbox provider's admin console also helps. Google Workspace and Microsoft 365 both show DKIM status in their admin settings. If you are still choosing between them, our Microsoft 365 vs. Google Workspace pricing comparison covers the plans.

The Bottom Line on SPF, DKIM and DMARC

Three DNS records protect your customers from fake invoices and keep your own mail out of spam. Publish one SPF record, switch on DKIM in every sending service and roll DMARC from none to reject over a few weeks.

Little iApps publishes setup guides for the tools small businesses rely on, written for people who run the business rather than the servers. Start today with the sender list. Once it is complete, the records themselves take less than an hour.