SPF, DKIM and DMARC: how to set up email authentication

SPF, DKIM and DMARC are three records in your domain's DNS that let a receiving mail server check whether a message claiming to come from your domain really does. Set up email authentication and Gmail, Outlook and Yahoo can tell your real invoice from a fraudster's copy. Skip it, and your own mail is the one that looks suspicious.

• SPF (Sender Policy Framework) lists the servers and services that may send mail for your domain.
• DKIM (DomainKeys Identified Mail) puts a digital signature on every message, which proves it was sent by your domain and not changed on the way.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) checks that SPF or DKIM passed for the domain in the visible From address, tells receivers what to do when neither did, and sends you reports.

The key idea is alignment. SPF checks the hidden envelope address that bounces go to, and DKIM checks whichever domain signed the message. A newsletter tool can pass both for its own domain while your name sits in the From line. DMARC only passes when at least one of the two passed for your domain, or for a subdomain of it.

For years these records were good practice. Since February 2024 they have been the price of entry at the large consumer mailbox providers, and since 2025 they have been enforced with rejections, not just warnings.

These rules protect personal mailboxes: Google says its requirements apply to mail sent to personal Gmail accounts. Business mailboxes on Microsoft 365 or Google Workspace follow their own administrators' settings, and Microsoft 365 can apply your DMARC policy to incoming mail as well.

Below 5,000 messages a day you are not exempt in practice. A message with neither SPF nor DKIM already fails Gmail's rule for every sender. And a domain without DMARC is easy to spoof: criminals send fake invoices in your name, and the complaints damage your reputation, not theirs.

In the Netherlands, the government has made these standards compulsory for itself. DMARC, DKIM and SPF are on the "pas toe of leg uit" list of Forum Standaardisatie, and government bodies agreed to use a strict policy on all their domains: quarantine or reject for DMARC, ~all or -all for SPF. That obligation binds the government and its procurement, not companies. It is still a useful yardstick, and internet.nl, the test of the Dutch Internet Standards Platform, uses the same one.

If your company falls under the Cyberbeveiligingswet, the Dutch NIS2 law, you must also take proportionate measures against your cyber risks. Email spoofing is one of the most common of those risks, so these three records belong in that work. Our guide to the Cyberbeveiligingswet (NIS2) explains who is in scope.

Each record is a line of text with a fixed start and a few tags. Below are the three records of a fictional company at example.com whose mailboxes run on Google Workspace and whose web server sends the contact form mail.

Microsoft 365 works differently. You do not paste a key: you create two CNAME records, selector1._domainkey and selector2._domainkey, that point to keys Microsoft hosts and rotates for you. Their targets look like selector1-example-com._domainkey.yourtenant.n-v1.dkim.mail.microsoft, but the exact values differ per tenant, so copy them from the Defender portal, never from an example.

The order matters. First find out who sends mail as you, then make each of them pass SPF or DKIM, and only then publish DMARC.

1. 1

   List every service that sends as your domain

   Your mailbox provider, the newsletter tool, the invoicing or accounting software, the webshop, the website's contact form, the CRM, the phone system that emails voicemail. Ask your colleagues: the forgotten ones are the ones that break.

2. 2

   Write one SPF record

   Combine the include of every service into a single TXT record on your domain. Services that send with their own envelope domain, as many newsletter tools do, need DKIM rather than an include. Count the lookups and stay under ten.

3. 3

   Switch on DKIM at every service

   In Microsoft 365 or Google Workspace, and in every tool that offers "domain authentication". Each one gives you records to publish: add them, wait until they are visible, then start signing.

4. 4

   Publish DMARC with p=none

   Add the TXT record on _dmarc with a rua address you actually read. Delivery does not change yet; reports usually start arriving within a day or two.

5. 5

   Test and read the reports

   Check the domain at internet.nl and send a test message to a Gmail address. Then read the reports for a few weeks before you tighten the policy.

A policy of p=none protects nobody: it only reports. Protection starts at quarantine and is complete at reject, when receivers refuse mail that pretends to be you. The way there is to read the reports until every legitimate sender passes.

In the reports, look for three kinds of rows. Your own services that fail: fix them before you go on. Unknown servers that fail: that is spoofing, and the policy will stop it. Mailing lists and forwarding that fail: normal, because forwarding breaks SPF, while DKIM usually survives if the message is not changed.

Older guides suggest stepping up with pct=, which applies the policy to a percentage of failing mail. The original DMARC standard (RFC 7489) allowed it, and Microsoft still describes steps from pct=10 to pct=100. The new DMARC standard, RFC 9989 of May 2026, removed pct and added a simpler test flag, t=y. Receivers will take time to catch up, so for a small business the plain path is the safest: none, then quarantine, then reject, each for as long as the reports need.

Test from the outside, the way a receiving server sees you.

• internet.nl (opens in a new tab): enter your domain in the email test. It checks DMARC, DKIM and SPF and treats quarantine or reject (DMARC) and ~all or -all (SPF) as strict enough.
• The message headers: send a message to a Gmail address, open it and choose Show original. Gmail lists SPF, DKIM and DMARC with PASS or FAIL. In other mail clients, look for the Authentication-Results line: you want spf=pass, dkim=pass and dmarc=pass, with your domain after header.d and header.from.
• The DMARC reports: after a day or two, your rua mailbox receives zipped XML files from Google, Microsoft and others. Each row is a sending server with its message count and results.

The most common mistakes:

• More than ten lookups. Every service brings an include, and some includes hide three or four more. SPF then fails with a permerror for all your mail. Remove services you no longer use, or move a newsletter tool to a subdomain with its own record.
• Two SPF records. A new tool says "add this SPF record" and someone adds it next to the old one. Merge them into one.
• A forgotten newsletter or invoicing tool. It sent fine for years and lands in spam the week you switch to quarantine. That is what the weeks at p=none are for.
• DKIM published but never switched on. The records are in DNS, but nobody started signing in Microsoft 365 or Google Workspace, so DMARC rests on SPF alone and fails as soon as a message is forwarded.
• A rua address at another domain. If reports go to a mailbox on a different domain, that domain must publish an authorisation record (example.com._report._dmarc.otherdomain.com), or receivers send nothing. Report services set this up for you; on a second domain of your own, you add it yourself.

Rather have someone check it? A Secure security scan, from €495, checks your website, domain and email for known weaknesses and ends in a plain-language report. Setting up SPF, DKIM and DMARC is part of our hardening work, and continuous checks, from €75 a month, flag new weaknesses early. Or ask us about your domain first.