Webmail request
en
Webmail request
nl en fr de
Deliverability

Setting up SPF, DKIM and DMARC together

You set up SPF, DKIM and DMARC in one logical order: first SPF (which servers may send), then DKIM (a signature that makes your message genuine), and finally DMARC (the policy that ties the two together and tells the recipient what to do on a failed check). Together they ensure your mail arrives reliably and that others can't simply email on your behalf. You don't need to be an expert for it, but the order is important.

By the Mailflux team Published on

Why set up SPF, DKIM and DMARC together?

Each of the three covers a different gap, and only together do they close the door. A common question is exactly how SPF, DKIM and DMARC stop email spoofing. The answer: SPF limits who may send on your behalf, DKIM proves that a message wasn't altered in transit, and DMARC links those checks to the visible sender and determines what happens when something goes wrong. Anyone who wants to email on your behalf then has to clear all three hurdles, and a fraudster can't just do that.

You'll find separate explanations per component in the pieces on what SPF is, what DKIM is and what DMARC is. This guide brings them together.

Since 2024 this is moreover no longer a luxury: major mail providers require bulk senders to have their email correctly authenticated. What that means concretely, you'll read in email authentication: why it's now required.

Antispam settings with a whitelist and blacklist

Step 1: setting up SPF

Start with SPF, because it's the foundation and the other layers build on it.

  1. Map out which sources send on your behalf: your email provider, but for example also a newsletter tool or accounting package.
  2. Publish one SPF record (type TXT) in your DNS that contains all those sources, for example v=spf1 include:_spf.yourprovider.eu -all.
  3. Keep it to one SPF record and stay under the limit of ten DNS lookups.

Note: two separate SPF records cause errors. Combine everything in one line.

Step 2: setting up DKIM

Then add the digital signature.

  1. Have your provider generate a key pair. The secret key stays on the sending server; you get the public key.
  2. Publish the public key as a TXT record on your selector, for example selector1._domainkey.yourdomain.eu.
  3. Turn on signing, so that every outgoing message gets a signature.
  4. Send a test message and check whether the signature is valid.

Copy the public key in full; one missing character makes the check invalid.

Step 3: setting up DMARC

Only set up DMARC once SPF and DKIM both pass reliably.

  1. Publish a DMARC record (type TXT) at _dmarc.yourdomain.eu, to start with p=none, for example v=DMARC1; p=none; rua=mailto:reports@yourdomain.eu.
  2. Read the reports that come in and check whether all legitimate sources pass SPF and DKIM.
  3. Then gradually move up to p=quarantine and eventually to p=reject.

Never set DMARC straight to reject: without observing first, you risk your own mail being refused.

Checklist

Run through this as confirmation that everything is right:

  • One SPF record with all sending sources, ending in -all.
  • DKIM signing active and the public key correctly published.
  • A test message with valid SPF and DKIM checks.
  • DMARC record published, started on p=none.
  • Reports read before you tighten the policy.
  • Policy gradually raised to quarantine and reject.

After each step, send a test message to an address at a major mail provider and check in the message details whether SPF, DKIM and DMARC are all three reported as passed. That way you know for sure you haven't forgotten anything before you tighten the DMARC policy.

If your mail keeps ending up in spam despite everything, look at the broader causes in why your mail ends up in spam.

How Mailflux arranges this for you

With Mailflux you don't have to work through this step-by-step plan yourself. We manage SPF, DKIM and DMARC for your domain and monitor the IP reputation of our sending servers, so the three layers are set up correctly and aligned with each other. Every plan also filters with machine learning against spam, phishing and malware, with standard antivirus, antispam, antimalware and automatic backups.

You get professional email on your own domain, hosted in Europe and GDPR-compliant, with optional two-factor authentication. We take on the full authentication behind the scenes; you only have to email.

Ready to start?

Professional email on your own domain, hosted in Europe and GDPR-compliant. Request your mailbox with no obligation.

Get started

FAQ

Frequently asked questions

In what order do I set up SPF, DKIM and DMARC?

Always SPF first, then DKIM, then DMARC. SPF and DKIM are the building blocks; DMARC rests on them and determines what happens when a check fails. If you set up DMARC before the other two are right, you risk your own legitimate mail being refused.

How do SPF, DKIM and DMARC prevent spoofing?

Together they force a forger to clear three hurdles at once: sending from an allowed server (SPF), placing a valid signature (DKIM) and matching the visible sender (DMARC alignment). A fraudster without access to your domain and keys can't do that, so their mail is stopped.

How long before the settings work?

The DNS records themselves are published quickly, but changes can take up to a day to take effect due to caching. DMARC then requires patience: you first leave the policy on none for a few weeks to collect reports, before moving up to quarantine and reject.

Read more