SPF, DKIM and DMARC: A Setup Checklist for Business Email Senders

Google requirements read on 28 October 2026. Your email provider's own instructions are the reference for the exact DNS records.

What are SPF, DKIM and DMARC?

SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature that receivers can check. DMARC tells receivers what to do when SPF or DKIM checks fail and sends you reports. Together they let a receiving server see that a message really comes from your domain.

Do I need all three?

For senders of more than 5,000 messages per day to Gmail, Google requires SPF and DKIM and a DMARC policy (the policy can be "none"), plus valid forward and reverse DNS records and TLS (Google). Below that volume it is still the baseline expected by most receivers.

In what order should I set them up?

1. Make an inventory of every service that sends mail as your domain (company mail, newsletter tool, CRM, support desk, outreach tool).
2. Publish one SPF record that includes all of them.
3. Enable DKIM signing in each service and publish the keys it gives you.
4. Publish a DMARC record with policy "none" and an address for reports.
5. Read the reports for a few weeks, fix the senders that fail, then consider a stricter policy.

What is the most common SPF mistake?

Publishing two SPF records for the same domain, or listing so many services that the record exceeds the lookup limit. Keep one record, and remove services you no longer use.

What does "alignment" mean?

For DMARC to pass, the domain in the From header must match the domain checked by SPF or DKIM. Google lists this as a requirement for direct email. A tool that sends "from your domain" using its own signing domain can fail DMARC even when SPF and DKIM pass individually.

What else does Google require?

Keep the spam rate in Postmaster Tools below 0.30% (Google recommends below 0.10%), format messages according to RFC 5322, do not impersonate Gmail From headers, and support one-click unsubscribe with a clearly visible link in marketing messages.

How do I test the setup?

Send a test message to a mailbox that shows the original headers and read the SPF, DKIM and DMARC results. Repeat for each sending service. Check again after any DNS or tool change.

Where does this fit in cold outreach?

Authentication is necessary but not sufficient: list quality, volumes and legal basis matter just as much. See B2B Cold Email in Europe Without Landing in Spam.

Originally published at https://get-scala.com/en/blog/spf-dkim-dmarc-setup-checklist.