25% discount on all new client orders. Talk to us
Sitefitters
Contact us Find a Fit
Learn / How-To Guides

How to Set Up SPF, DKIM and DMARC So Your Emails Don’t Land in Spam

SPF, DKIM and DMARC are three short DNS records that prove your emails really come from your business. In this guide you will add all three, check that they pass, and set a safe starting policy that you can tighten later.

This is no longer optional. Gmail requires every sender to use SPF or DKIM, and larger senders to use all three. Yahoo and Microsoft Outlook have similar rules. Without them, your quotes, invoices and replies are more likely to land in spam or be rejected, and scammers can more easily send fake emails in your name.

⏱ 30 minutes◎ Intermediate☰ 8 steps↻ Updated Oct 2026

What you need

  • Access to your domain’s DNS settings or cPanel
  • A list of every service that sends email as your domain
  • Admin access to your email provider
  • An inbox for DMARC reports

Steps

1

List everything that sends your email

Write down every service that sends mail using your domain. That includes your mailbox provider, your website’s contact forms, your newsletter tool, your invoicing or booking software and your CRM. Each one needs to be covered by SPF or DKIM, or its messages will fail the checks. Missing a service here is the most common reason a setup breaks later.

2

Check your current status

If your email and DNS are on cPanel hosting, go to Email, then Email Deliverability. It shows each domain and flags problems with DKIM, SPF and reverse DNS. If your DNS lives elsewhere, use a free online SPF and DMARC checker, or open your registrar’s DNS settings and look for TXT records that start with v=spf1 or v=DMARC1.

3

Create one SPF record

SPF is a TXT record on your root domain that lists the servers allowed to send your mail. It starts with v=spf1, then includes each service, then ends with ~all or -all. For example, v=spf1 include:_spf.google.com ~all for Google Workspace. Each service tells you what to add. Combine them all into one record, because two SPF records on the same domain cause both to fail.

Tip: SPF allows only 10 DNS lookups, so remove services you no longer use.
4

Turn on DKIM signing

DKIM adds a hidden digital signature to each message. You switch it on inside each sending service, which then gives you a TXT or CNAME record to publish. In cPanel, Email Deliverability creates the DKIM key and offers a Repair button when your host runs your DNS. Google Workspace and Microsoft 365 have their own DKIM settings in the admin center. Use a 2048-bit key when offered.

5

Use cPanel’s Repair or Copy option

In Email Deliverability, click Manage next to your domain. If your server controls your DNS, click Repair and confirm the suggested records. If your DNS is hosted at your registrar or another provider, Repair is unavailable. Instead, click Copy next to the suggested SPF or DKIM record and paste the name and value into your registrar’s DNS settings as new TXT records.

6

Add a DMARC record

DMARC tells receiving servers what to do when a message fails SPF and DKIM, and where to send reports. Add a TXT record with the name _dmarc and a value like v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com. The p=none policy only monitors, so nothing is blocked while you learn. Use an inbox you check, or a free DMARC report service, for the address.

Tip: DMARC only works once SPF and DKIM are already in place.
7

Test and read your reports

Wait an hour or so, then send a test email to a Gmail account. Open it, choose Show original from the menu, and look for SPF, DKIM and DMARC marked PASS. Over the next two to four weeks, review the DMARC reports. They show which services send mail as your domain and whether each one passes. Fix any legitimate service that fails before moving on.

8

Tighten your DMARC policy

Once every real sender passes, change p=none to p=quarantine, which sends failing mail to spam. After a few more weeks with no problems, you can move to p=reject, which blocks fake mail outright. This stops scammers from sending invoices or password requests that appear to come from your business. Go slowly, because a strict policy will also block a real service you forgot.

Common Mistakes

  • Publishing two separate SPF records instead of combining every service into one, which makes SPF fail for all of them.
  • Jumping straight to a p=reject DMARC policy before checking reports, which blocks real invoices or form emails.
  • Forgetting the website contact form or newsletter tool, so those messages fail authentication and land in spam.

FAQ

Do small businesses really need DMARC?

Yes. Gmail and Yahoo require DMARC for anyone sending 5,000 or more messages a day, and Microsoft Outlook has a similar rule. Even if you send far less, DMARC helps your mail get delivered and makes it much harder for criminals to send fake emails in your name to your customers.

What is the difference between ~all and -all in SPF?

Both end your SPF record. The ~all version, called soft fail, tells servers that mail from unlisted servers is suspicious. The -all version, called hard fail, says it should be rejected. Soft fail is the safer starting point, since DMARC then decides the final action based on your chosen policy.

How long do these records take to work?

New DNS records usually start working within an hour, but some can take up to 48 hours to reach every mail server. cPanel’s Email Deliverability tool may take a few minutes to recheck after a repair. Send a test message after a few hours and check the results in the message headers.