How to configure SPF, DKIM and DMARC

Quick answer: SPF, DKIM and DMARC are three DNS-published policies that let receiving servers verify your email is genuine. SPF lists the servers allowed to send for your domain, DKIM signs each message cryptographically, and DMARC tells receivers what to do when a message fails both. All three are TXT records.

Overview

Without these records, modern mailbox providers treat your mail with suspicion — expect spam-foldering or outright rejection. Publishing the trio is the single biggest deliverability win for any domain that sends email, whether from a VPS or a third-party provider.

Before you start

• A list of every service that legitimately sends mail for the domain (your server, newsletter tool, CRM…).
• The DKIM public key or CNAME targets from your mail software/provider.
• Access to the authoritative DNS panel (how TXT records work).

Step-by-step guide

1. SPF — one TXT record on @:

v=spf1 a mx include:_spf.provider.com ~all

2. DKIM — publish the key your mailer generated on selector._domainkey:

default._domainkey  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

3. DMARC — a TXT record on _dmarc, starting relaxed and tightening later:

v=DMARC1; p=none; rua=mailto:[email protected]

4. Verify all three with dig +short TXT on each host, send a test message to a Gmail address and check “Show original” for spf=pass dkim=pass dmarc=pass.
5. After a few clean weeks, raise DMARC to p=quarantine, then p=reject.

Common issues

• Second SPF record added instead of merging: two v=spf1 records = permanent SPF failure.
• Too many SPF lookups: the 10-DNS-lookup limit is easy to exceed with many include: entries.
• DKIM selector mismatch: the record must sit exactly on the selector name your mailer signs with.

When to contact support

Deep dives per mechanism: SPF, DKIM, DMARC. If mail from your Cloud2Y server still lands in spam with all three passing, open a ticket — the PTR record and IP reputation are the next suspects.

Frequently asked questions

Do I really need all three records?

Yes for reliable delivery: SPF authorizes your sending servers, DKIM cryptographically signs messages, and DMARC tells receivers how to treat failures. Gmail and others expect all three.

What DMARC policy should I start with?

Start with p=none plus a rua reporting address to observe results without risk, then move to p=quarantine and finally p=reject once reports show all legitimate mail passing.

Why is having two SPF records a problem?

The standard requires exactly one v=spf1 record per name; publishing two makes receivers treat SPF as a permanent error. Merge all mechanisms into a single record instead.

Related articles

• How to configure DNS for email services
• How to configure TXT records
• How to configure MX records
• How to set reverse DNS / PTR record

Ready to get started? Order a VPS at Cloud2Y →