What SPF, DKIM and DMARC Each Prove
Each record answers a different question.
- SPF (RFC 7208) lists the servers allowed to send mail for a domain. Receivers check it against the envelope sender, the hidden "MAIL FROM" or Return-Path address, not the From line your client sees.
- DKIM (RFC 6376) adds a signature to each message. The receiver fetches a public key from DNS at
selector._domainkey.yourdomainand checks the signature against the domain in itsd=tag. - DMARC ties them to the visible From address. A message passes only if SPF or DKIM passes and the domain that passed matches the From domain. That match is called alignment.
Alignment is the piece people skip. A newsletter tool may send your campaign with its own bounce domain. SPF passes for the tool, not for you, so DMARC fails unless the tool also signs with DKIM as your domain.
One more thing to get straight early: passing all three doesn't buy an inbox. The current DMARC standard, RFC 9989, says a DMARC pass only shows the domain was used with permission, and "does not guarantee" delivery. Authentication gets you judged on your own reputation instead of someone else's. Complaints and sending habits still decide the rest.
What Gmail, Yahoo and Outlook.com Require in 2026
The big mailbox providers set different bars for everyday senders and bulk senders. Google's email sender guidelines and sender guidelines FAQ, Yahoo's sender requirements and Microsoft's Outlook.com high-volume sender announcement boil down to this:
| Provider | Every sender | Bulk senders (about 5,000+ a day) |
|---|---|---|
| Gmail | SPF or DKIM, valid forward and reverse DNS, TLS, spam rate below 0.3% in Postmaster Tools | SPF and DKIM, DMARC (p=none is accepted), From domain aligned with SPF or DKIM, one-click unsubscribe on marketing mail |
| Yahoo | SPF or DKIM, spam rate below 0.3%, valid forward and reverse DNS | SPF and DKIM, DMARC of at least p=none that passes, one-click List-Unsubscribe, unsubscribes honoured within 2 days |
| Outlook.com, Hotmail, Live | Recommended rather than enforced | SPF and DKIM must pass, DMARC of at least p=none aligned with SPF or DKIM; since May 5, 2025 failing mail is rejected with "550 5.7.515" |
Two details from Google's FAQ matter for growing businesses. The 5,000 count covers everything sent from the same primary domain, subdomains included, and crossing it once makes you a bulk sender permanently. And since November 2025 Google has been "ramping up" enforcement, with temporary and permanent rejections. Its target spam rate is below 0.1%, not just under 0.3%.
A ten-person office sending quotes will never hit 5,000 a day, but Google still recommends all three for every domain. So do we.
Before You Touch DNS: List Everything That Sends as You
SPF and DKIM fail most often for a sender nobody remembered. Before writing a single record, list every system that puts your domain in the From line:
- Your mailboxes: cPanel email, Google Workspace or Microsoft 365
- The website itself: contact forms, booking plugins, WooCommerce order emails
- Newsletter, invoicing, CRM and helpdesk tools
The website is the one people forget. This site's own contact form, contact-submit.php, sends through PHP's mail() on cPanel hosting from a no-reply address on our domain, and it passes the -f flag so the envelope sender is on our domain too. Leave that flag out and the Return-Path can fall back to an address on the server's own hostname. SPF then checks the wrong domain, and DMARC has nothing aligned to count.
SPF DKIM DMARC Setup, Step by Step
- Publish one SPF record at the root of the domain (
@in most DNS panels), listing every sender from your inventory. - Turn on DKIM in every sending service and publish each service's key under its own selector.
- Wait at least 48 hours. Google's DMARC guide asks for SPF and DKIM to be authenticating for that long before you add DMARC.
- Publish DMARC at p=none with a reporting address, then tighten in stages as the reports come back clean.
SPF: one record, ten lookups
Three common SPF records, using 203.0.113.25 as a stand-in for your hosting server's IP:
# Mail and website both on cPanel hosting
v=spf1 +a +mx +ip4:203.0.113.25 ~all
# Google Workspace mailboxes, contact form sent from the cPanel server
v=spf1 ip4:203.0.113.25 include:_spf.google.com ~all
# Microsoft 365 only (Microsoft's own example)
v=spf1 include:spf.protection.outlook.com -allThe Google include comes from Google's Set up SPF page and the Microsoft line from its SPF guide.
The rule that catches growing businesses is in section 4.6.4 of RFC 7208. The include, a, mx, ptr and exists mechanisms and the redirect modifier each cost a DNS lookup, and evaluation must stop with a "permerror" after 10. The count runs through nested includes, so one vendor's include can quietly use three or four of your ten. ip4, ip6 and all cost nothing. If +a and +mx both point at the same server, an ip4: entry does the same job for free.
On the ending: Google recommends ~all (softfail), and cPanel suggests it by default, while Microsoft's examples use -all. RFC 9989 points out a catch with -all. Some receivers check SPF early and may reject a hard fail before DMARC runs, even when an aligned DKIM signature would have passed. While you are still finding senders, ~all is the safer choice.
DKIM: a selector for each sender
Each service keeps a private key and gives you a public one to publish:
- cPanel: Email Deliverability, then Manage next to the domain. cPanel's DKIM record lives at
default._domainkey, as its API documentation shows. - Google Workspace: in the Admin console, Apps > Google Workspace > Gmail > Authenticate email, then Generate New Record. The default selector is
google. Choose 2048-bit if your DNS host supports it, publish the TXT record, then come back and click Start authentication, per Google's DKIM guide. - Microsoft 365: in the Defender portal's Email authentication settings, DKIM tab. Microsoft uses two CNAME records,
selector1._domainkeyandselector2._domainkey, not a TXT key, according to its DKIM article. Copy the exact targets from the portal.
# cPanel DKIM record (public key shortened here)
default._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"
# Google Workspace DKIM record
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"A 2048-bit key is longer than the 255 characters one DNS string can hold, so it is split into quoted chunks. cPanel's Manage screen has a Split view for DNS hosts that don't split records automatically. RFC 8301 sets 1024 bits as the minimum and recommends 2048.
DMARC: a staged rollout
DMARC is a TXT record at _dmarc.example.com. Point the reports at a dedicated mailbox, not your own inbox, because they arrive daily from every receiver that sends them. RFC 9989 says receivers must not send aggregate reports when there is no rua tag, so a record without one tells you nothing.
# Stage 1: monitor only
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
# Stage 2: failing mail goes to spam
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
# Stage 3: failing mail is refused
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"| Stage | Minimum time | Move on when |
|---|---|---|
| p=none | At least a month | Every legitimate source in the reports passes with an aligned domain |
| p=quarantine | As long again | No real mail turns up in spam and staff have been warned |
| p=reject | Ongoing | Keep reading reports; DKIM must be signing everything |
Those durations come from section 7.4 of RFC 9989, which says a domain heading for p=reject should first publish p=none "for at least a month," then p=quarantine "for an equally long period." It also says a p=reject domain must not rely on SPF alone, because forwarding breaks SPF while DKIM signatures usually survive. Staff who post to mailing lists are the other risk at reject, so ask before you go that far.
One change older guides miss: many still suggest ramping up with pct=25, pct=50 and so on, and Google's DMARC page still describes pct. RFC 9989, published in May 2026 and replacing RFC 7489, lists pct as historic and adds a t=y test flag instead. Since you can't count on every receiver to honour either tag, plan the rollout around the three policy levels and time.
Check the Records With dig and nslookup
Run these after every change:
# SPF: one line starting v=spf1, never two
dig +short TXT example.com
# DKIM: use the selector your sender uses
dig +short TXT default._domainkey.example.com
dig +short TXT google._domainkey.example.com
dig +short CNAME selector1._domainkey.example.com
# DMARC, asked of a public resolver to skip local caches
dig @8.8.8.8 +short TXT _dmarc.example.com
# Reverse DNS for the sending IP
dig +short -x 203.0.113.25
# Windows equivalent
nslookup -type=TXT _dmarc.example.comDNS only proves the records exist. To see how real mail is judged, send a message to a Gmail address you control, open it, and choose More > Show original next to Reply. The Authentication-Results header will read something like this:
dkim=pass header.i=@example.com header.s=default;
spf=pass ... smtp.mailfrom=no-reply@example.com;
dmarc=pass ... header.from=example.comCompare smtp.mailfrom and the DKIM header.i domain with header.from. If neither matches, you have an alignment problem, not a missing record. Repeat for every sender on your list, the contact form included.
Using cPanel's Email Deliverability Tool
On cPanel hosting, start with cPanel's Email Deliverability interface. It lists each domain with the status of its mail-related DNS records, offers suggested SPF, DKIM and DMARC records, and checks reverse DNS for the server. Some things to know before clicking anything:
- Repair only works if the server runs your DNS. If your nameservers are at your registrar or Cloudflare, copy the suggested record into that DNS panel instead.
- It doesn't know your other senders. Use Customize to add Google's, Microsoft's or a newsletter tool's include to the suggested SPF record before installing it.
- Forms can still fail DKIM. The documentation warns that mail sent from PHP may not get a DKIM signature on servers using the DSO handler without MPM ITK, and lists two Exim settings the host can turn on. Only your host can change that.
- It may be switched off. The interface only appears if your host enables it in WHM.
Common SPF, DKIM and DMARC Mistakes
- Adding a second SPF record for a new tool. Merge the new include into the existing record. RFC 7208 allows only one; we covered this in our host migration guide.
- Doubling the domain in the host name. Many DNS panels, GoDaddy's included, add the domain for you. Type
_dmarc, not_dmarc.example.com, or you publish at_dmarc.example.com.example.com. - Publishing a TXT key for Microsoft 365. Microsoft expects the two selector CNAMEs; its DKIM article lists a TXT key there as not supported.
- Jumping straight to p=reject. The first DMARC reports almost always show a sender someone forgot.
- Leaving DMARC at p=none forever. Monitoring mode protects nobody from spoofing. It's a stage, not a destination.
Frequently Asked Questions
Do I need DMARC if I send fewer than 5,000 emails a day?
Gmail and Yahoo only require it from bulk senders, but Google recommends DMARC for every sending domain. A p=none record with a report address costs nothing and shows who is sending as your domain, spoofers included.
Should my SPF record end in ~all or -all?
Google and cPanel suggest ~all, and Microsoft's examples use -all. RFC 9989 warns that -all can get mail rejected before DMARC is checked, even when DKIM would have passed. Use ~all while you are still finding senders, and let DMARC do the enforcing.
How long should I stay on p=none?
RFC 9989 suggests at least a month at p=none, then an equally long period at p=quarantine before p=reject. Move on only when every legitimate source in your aggregate reports passes with an aligned domain.
Why does DMARC fail when SPF passes?
Because SPF passed for a different domain. Newsletter and invoicing tools often use their own envelope sender, so SPF passes for them but doesn't align with your From address. Turn on the tool's DKIM signing with your domain, or a custom bounce domain if it offers one.
Will SPF, DKIM and DMARC stop my emails going to spam?
They remove one big reason, not all of them. RFC 9989 says a DMARC pass does not guarantee delivery, and Google still filters on complaints and sending habits.