Set Up SPF, DKIM & DMARC – Configure Email DNS Correctly

Quick answer: SPF, DKIM and DMARC are DNS TXT records that prove your emails are legitimate. Without them emails land in spam or get rejected – with correct configuration you improve deliverability and protect your domain from spoofing.

Why SPF, DKIM & DMARC?

SPF: Tells receiving servers which IPs may send email for your domain
DKIM: Digital signature – proves email wasn't tampered with
DMARC: Policy for failed SPF/DKIM + reporting

Step 1: Set MX record

Type: MX
Name: @
Value: mail.yourdomain.com
Priority: 10

Step 2: Set up SPF

Type: TXT
Name: @
Value: "v=spf1 mx a ip4:93.184.216.34 -all"

Scenario	SPF record
Own mail server only	`v=spf1 mx -all`
With Google Workspace	`v=spf1 include:_spf.google.com -all`
With Microsoft 365	`v=spf1 include:spf.protection.outlook.com -all`

Step 3: Set up DKIM

Type: TXT
Name: default._domainkey
Value: "v=DKIM1; k=rsa; p=MIIB..."

Step 4: Set up DMARC

Type: TXT
Name: _dmarc
Value: "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Test setup

mail-tester.com (target: 9/10 or 10/10)
mxtoolbox.com for SPF, DKIM, DMARC

Related guides

Frequently asked questions (FAQ)

Is SPF alone enough for email delivery?

No. SPF alone is not enough – DKIM and DMARC are standard today. Many providers (Gmail, Outlook) evaluate all three.

What does -all vs. ~all mean in SPF?

-all = hard fail (strict rejection of unauthorized senders, recommended). ~all = soft fail (suspicious but not strictly rejected).

How do I test if SPF/DKIM/DMARC work?

Send a test email to mail-tester.com and check the score. Alternatively: mxtoolbox.com for individual record checks.

NexoraHost

Register a domain

Connect your domain to webspace, email or game server – unlimited DNS records.

Order now → Account

Game servers V-Server Root server Webspace Domains

nexorahost.com · Maincubes FRA01 · 1 Tbit/s DDoS · 99,9 % Uptime