SPF, DKIM & DMARC: Email Authentication Setup Guide for B2B Senders

Since Google and Yahoo tightened their bulk-sender rules, email authentication has gone from “nice to have” to non-negotiable. If your domain is missing SPF, DKIM or DMARC records, mailbox providers may reject or spam-folder your cold emails before a human ever sees them — no matter how good your copy is. The good news: setting all three up takes under an hour, and you only have to do it once per domain. Here is exactly what each record does and how to configure them.

What SPF, DKIM and DMARC Actually Do

All three are DNS records that prove your emails really come from you:

• SPF (Sender Policy Framework) lists which servers are allowed to send email on behalf of your domain. If a message arrives from a server not on the list, receivers treat it with suspicion.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. The receiving server checks the signature against a public key in your DNS to confirm the email was not altered in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when SPF or DKIM fails — deliver anyway, quarantine, or reject — and sends you reports about who is sending mail as your domain.

Think of SPF as the guest list, DKIM as the ID check, and DMARC as the bouncer’s instructions.

Step 1: Publish Your SPF Record

SPF lives as a TXT record on your root domain. A typical record for a Google Workspace sender looks like this:

v=spf1 include:_spf.google.com ~all

1. Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.).
2. Create a TXT record on @ (the root) with the value above, adding an include: for every platform that sends mail for you — your email provider, CRM, and any sending tool.
3. Keep it to one SPF record per domain. Multiple SPF records invalidate each other; merge all includes into a single record.
4. Stay under the 10-DNS-lookup limit. If you use many tools, consider a subdomain for outreach instead of piling includes onto your main domain.

Step 2: Enable DKIM Signing

DKIM is generated by your email provider, not written by hand:

1. In Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a 2048-bit key.
2. Copy the generated TXT record (it looks like google._domainkey) into your DNS.
3. Return to the admin console and click “Start authentication.”
4. Repeat inside Microsoft 365 or your ESP if you send from multiple platforms — each gets its own selector, so they coexist happily.

Verify it worked by sending yourself a message and checking the headers for dkim=pass.

Step 3: Add a DMARC Policy (Start Relaxed)

DMARC is a TXT record on _dmarc.yourdomain.com. Start with a monitoring-only policy:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The p=none policy changes nothing about delivery but starts sending you aggregate reports showing every source sending as your domain. After two to four weeks of clean reports, tighten it:

1. Move to p=quarantine; pct=25 and watch for legitimate mail getting flagged.
2. Raise pct gradually to 100.
3. Finish at p=reject for full spoofing protection — this is also what mailbox providers increasingly expect from senders they trust.

Common Mistakes That Undo Everything

• Two SPF records. The most common error we see when auditing client domains. Merge them.
• Authenticating the main domain but sending from an unauthenticated subdomain. Every sending domain and subdomain needs its own DKIM and DMARC alignment.
• Setting p=reject on day one. Without monitoring first, you may block your own invoicing tool or helpdesk.
• Forgetting new tools. Every time you add a sending platform, update SPF and enable its DKIM before the first campaign.

Authentication Is the Floor, Not the Ceiling

Passing SPF, DKIM and DMARC gets you considered for the inbox — it does not guarantee placement. Reputation still depends on volume discipline, engagement and list quality. Pair your authentication setup with a proper email warmup period, respect sensible daily sending limits, and verify every address before launch to keep bounces low (our email verification guide covers how). For the full picture of what determines inbox placement, see our complete email deliverability guide.

Set the records once, monitor the DMARC reports monthly, and your technical foundation is handled — leaving you free to focus on the part of outreach that actually books meetings: relevance and copy.