SPF, DKIM and DMARC: how to stop your email landing in spam

Why these three records matter

Email was designed without any way to prove who sent a message. Anyone can put accounts@example.in in the From line. SPF, DKIM and DMARC are three DNS records that close that gap. Receiving services such as Gmail, Yahoo and Outlook check them on every message, and mail that fails is far more likely to land in spam or be rejected.

In short:

Record	Question it answers	Where it lives
SPF	Is this server allowed to send mail for this domain?	TXT record on the domain
DKIM	Was this message signed by the domain, and is it unchanged?	TXT record at selector._domainkey.domain
DMARC	Did SPF or DKIM pass for the domain in the From address, and what should happen if not?	TXT record at _dmarc.domain

All examples below use example.in as a placeholder. Replace it with your own domain, and use the exact values your mail provider gives you. If DNS records are new to you, read what DNS is first.

SPF: who may send

SPF (Sender Policy Framework, RFC 7208) is a list of servers allowed to send mail using your domain in the envelope sender. Receivers look up the TXT record on your domain and check whether the sending server's IP is on the list.

; Mail sent only from your hosting server (cPanel or Plesk mailboxes)
example.in.  3600  IN  TXT  "v=spf1 a mx ~all"

; Mail sent through Google Workspace only
example.in.  3600  IN  TXT  "v=spf1 include:_spf.google.com ~all"

; Mail sent through Zoho Mail only
example.in.  3600  IN  TXT  "v=spf1 include:zohomail.com ~all"

; Hosting server plus Google Workspace, merged into ONE record
example.in.  3600  IN  TXT  "v=spf1 a mx include:_spf.google.com ~all"

What the parts mean:

• v=spf1 starts the record.
• a and mx allow the servers your A and MX records point to.
• include: pulls in another provider's list of servers.
• ~all (soft fail) marks everything else as suspicious. -all (hard fail) says everything else should be rejected. Most providers suggest ~all while you check, and some recommend -all once you are confident. Zoho's own guidance, for example, uses -all.

Two SPF rules catch many businesses:

1. One SPF record only. Two TXT records that both start with v=spf1 cause a permanent error, and SPF fails for every message. Merge them.
2. Ten DNS lookups maximum. Each include, a, mx and similar mechanism costs a lookup, including the lookups inside included records. Go over ten and SPF fails. Remove services you no longer use before adding new ones.

ODHOST note: If your domain uses your hosting's DNS, check the Email Deliverability page in cPanel (or the mail settings in Plesk). It shows the SPF and DKIM records the server expects. Use those exact values rather than a generic template.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail, RFC 6376) adds a digital signature to each outgoing message. Your mail server signs with a private key; you publish the matching public key in DNS. The receiver fetches the key and checks the signature. If the message was altered in transit, or was not signed by your domain, the check fails.

The record name includes a selector, a label chosen by your provider, so you can have several keys at once:

; Selector "default" for hosting mail (cPanel commonly uses this selector)
default._domainkey.example.in.  3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"

; Selector "google" for Google Workspace
google._domainkey.example.in.   3600  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"

The p= value is a long public key, shortened above. Copy it exactly from your provider's admin page; a single missing character breaks it. Some DNS editors split long values into several quoted strings, which is normal.

Google's sender guidelines require DKIM keys of at least 1024 bits and recommend 2048 bits. If your provider offers a choice, pick 2048.

For Google Workspace and Microsoft 365, you generate the DKIM key in their admin consoles, publish it in DNS, then switch signing on. Until you switch it on, the record exists but mail is not signed.

DMARC: the policy that ties it together

DMARC (RFC 9989, published in May 2026, replaced the earlier RFC 7489) checks one more thing: alignment. SPF or DKIM must pass for the same domain that appears in the visible From address. This stops a spammer passing SPF with their own domain while showing yours to the reader.

DMARC also tells receivers what to do with mail that fails, and where to send reports.

; Stage 1: monitor only, receive daily aggregate reports
_dmarc.example.in.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.in"

; Stage 2: send failing mail to spam
_dmarc.example.in.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.in"

; Stage 3: reject failing mail outright
_dmarc.example.in.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.in"

Tag	Meaning
p=	Policy: none (monitor), quarantine (spam folder) or reject
rua=	Where to send aggregate XML reports
sp=	Policy for subdomains, if different
adkim= / aspf=	Alignment mode: r relaxed (default) or s strict

Older guides often show a pct= tag for gradual rollout. RFC 9989 removed it, so do not rely on it in new records.

Recommended path: publish p=none with a rua address, read the reports for two to four weeks, fix any legitimate service that fails (billing software, a CRM, a website contact form sending through an outside service), then move to quarantine and later reject.

Aggregate reports are XML files. A free DMARC report reader makes them readable; many email security vendors offer one.

Gmail and Yahoo sender requirements

From February 2024, Gmail and Yahoo began enforcing new rules for people who send to their users. Google's email sender guidelines set two levels.

Everyone who sends to Gmail must:

• Set up SPF or DKIM for the sending domain.
• Have valid forward and reverse DNS (PTR) for sending IPs.
• Use TLS when transmitting mail.
• Keep the spam rate reported in Postmaster Tools below 0.3% (Google suggests aiming below 0.1%).
• Follow the standard message format (RFC 5322) and not impersonate Gmail From headers.

Bulk senders (more than 5,000 messages a day to Gmail accounts) must also:

• Set up SPF, DKIM and DMARC. A DMARC policy of p=none is enough.
• Align the From domain with the SPF or DKIM domain.
• Support one click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post headers) for marketing mail and show a visible unsubscribe link.

Yahoo's sender best practices set similar rules for bulk senders, including SPF and DKIM, a DMARC policy of at least p=none, one click unsubscribe and a complaint rate below 0.3%.

Most small businesses send far fewer than 5,000 messages a day. Even so, setting up all three records costs nothing and protects the domain from being spoofed in phishing mail aimed at your customers.

How to test your setup

1. Send a test from your business address to a Gmail account.
2. In Gmail, open the message, click the three dot menu and choose Show original. Look for SPF: PASS, DKIM: PASS and DMARC: PASS.
3. Check DNS directly:

nslookup -type=TXT example.in
nslookup -type=TXT _dmarc.example.in
nslookup -type=TXT default._domainkey.example.in

4. Use your control panel. cPanel's Email Deliverability tool reports SPF and DKIM problems for each domain.
5. Use Google Postmaster Tools if you send larger volumes, to watch spam rate and domain reputation.

Common errors and fixes

Symptom	Likely cause	Fix
SPF permerror	Two SPF records, or more than ten lookups	Merge into one record; remove unused includes
SPF passes but DMARC fails	SPF passes for the provider's domain, not yours	Turn on DKIM signing with your domain
DKIM fail or neutral	Key copied with a missing character, wrong selector, or signing not switched on	Recopy the key; check the selector; enable signing
DMARC record ignored	Published at example.in instead of _dmarc.example.in	Move it to the _dmarc name
Website form mail goes to spam	The site sends as your domain from an unlisted server	Send through an authenticated mailbox (SMTP) or add the service to SPF
Mail rejected after moving hosts	Old server IP still in SPF; new one missing	Update SPF to the new server

If your messages still land in spam once all three pass, the problem is usually content or reputation. The help article on emails going to spam covers the next checks, and the guide on creating a business email covers the mailbox setup itself.