SPF, DKIM and DMARC Explained: A Plain-English Guide for Business Owners

All three are stored in your domain's DNS settings. DNS is like the internet's phone book. It tells the world where to find your website, where to deliver your email and how to check your emails are genuine.

Your DNS might be managed by your domain registrar, your website provider, your hosting company or your IT company.

That's why fixing email settings sometimes involves two companies:



• Your email administrator gets the correct settings from inside Google Workspace or Microsoft 365 (they're unique to your business)
• Whoever manages your DNS adds them to your domain

Sometimes that's the same company. Often it isn't.

Not Sure Who Manages Your Email?

Ask yourself who you'd call if a staff member needed a new email address. That's usually your email administrator. It might be your IT company, someone in your team or the company you bought your email through.

Managing your website or domain doesn't automatically mean managing your email. They're separate services.

How to Set Up SPF and DKIM for Google Workspace

If your business email runs through Gmail with your own domain name, you're using Google Workspace. You'll need your Google Workspace administrator login, which isn't always the same login you use for your everyday inbox.



SPF for Google Workspace

If Google Workspace is the only service that sends email for your business, your SPF record will look like this:

Type: TXT | Host: @ | Value: v=spf1 include:_spf.google.com ~all

DKIM for Google Workspace

1. Sign in to the Google Admin Console.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. Select your domain. If it says DKIM is already authenticating, you're done.
4. If not, generate a new record. Choose 2048-bit if you're given the option.
5. Google will give you a TXT record with the host google._domainkey and a long value starting with v=DKIM1; k=rsa; p=
6. Add the record to your DNS, or send it to whoever manages your domain.
7. Once it's live (allow a few hours), go back to the same screen and click Start authentication.

That last step is the one people forget. Adding the record isn't enough on its own. Google won't start signing your emails until you click the button.

Need more detail? Follow Google's DKIM setup guide. You can also read Google's SPF setup guide.

How to Set Up SPF and DKIM for Microsoft 365

If you use Microsoft 365 directly, your SPF record is usually:

v=spf1 include:spf.protection.outlook.com -all

If you bought Microsoft 365 through GoDaddy, yours may be:

v=spf1 include:secureserver.net -all



The same rule applies: one SPF record only. And don't copy a record just because you recognise the provider's name. Check which services actually send your email first.

DKIM for Microsoft 365

Microsoft 365 uses two DKIM records rather than one.

1. Sign in to the Microsoft Defender email authentication settings with your Microsoft 365 admin account.
2. Find your business domain in the DKIM list. If signing is already turned on, you're done.
3. If not, select your domain to see the two records Microsoft needs. Both are CNAME records, named selector1._domainkey and selector2._domainkey.
4. Copy the exact values Microsoft gives you. Never guess them or copy them from another business. They're unique to you.
5. Add both records to your DNS, or send them to whoever manages your domain.
6. Once they're live, go back to Microsoft Defender and turn on DKIM signing.

Need more detail? Follow Microsoft's DKIM setup guide, or read Microsoft's overview of email authentication.

Bought Microsoft 365 Through GoDaddy?

You may not be able to reach these settings yourself. If that's the case, contact GoDaddy (or whoever sold you Microsoft 365) and ask:



How to Set Up DMARC (Google Workspace and Microsoft 365)

DMARC works the same way whichever email provider you use. If you don't have one yet, start with this:

Type: TXT  |  Host: _dmarc  |  Value: v=DMARC1; p=none;

This is "watch only" mode. It sets up DMARC without asking email providers to block anything, so there's no risk of accidentally stopping your genuine emails.

Already have a DMARC record? Leave it as it is unless you know why it was set up that way.

What about stronger DMARC settings?

Once you're confident all your genuine emails pass the checks, DMARC can be tightened:

• p=quarantine asks providers to send failing emails to spam
• p=reject asks providers to block them completely

These give stronger protection against scammers pretending to be you. But only switch them on once every service that sends email for you is set up correctly, or your own emails could be blocked.



Learn more in Google's DMARC guide or Microsoft's DMARC guide.

How to Check Your Settings Are Working

These free tools let you check your records are visible:

• MXToolbox: type in your domain to look up your records.
• Google Admin Toolbox: checks for common email setup problems.

Or try the simple test. Send an email to a Gmail address, open it, click the three dots in the top right corner and choose Show original. Near the top you'll see SPF, DKIM and DMARC listed, with PASS next to each one if everything is working.

Six Common Mistakes to Avoid

• Adding a second SPF record. Update the existing one instead.
• Copying DKIM settings from another business. Yours are unique to you.
• Overwriting a DMARC record without checking it first. It may already be set up correctly.
• Assuming your website company manages your email. It may be looked after somewhere else.
• Changing MX records to fix this. MX records control where your incoming email goes. Changing them won't fix SPF, DKIM or DMARC, but it could stop your email arriving.
• Expecting DMARC alone to fix every bounce-back. All three settings need to work together.



Frequently Asked Questions

The Bottom Line

SPF says who can send email for you. DKIM seals your emails. DMARC tells receivers what to do when something fails. Together they prove your emails are genuinely from you, and with email providers getting stricter every year, they're worth getting right before your emails start bouncing.



Already a Love My Online Marketing Client? We're Here to Help!

If you're unsure about your email security settings, get in touch. If we manage your DNS, we'll add the records we're responsible for. If your email is managed elsewhere, we'll point you towards the right people.



We want your website and business services working together as smoothly as possible! 🧡