Email: Adding an SPF, DKIM and DMARC record

Email authentication records help ensure your outgoing messages are delivered successfully, prevent messages from being marked as spam, and protect your domain against spoofing.

There are three important DNS records used for email authentication:

  • SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of your domain.
  • DKIM (DomainKeys Identified Mail): Adds a digital signature to outgoing messages, allowing receiving servers to verify their authenticity.
  • DMARC (Domain-based Message Authentication, Reporting & Conformance): Works alongside SPF and DKIM to help receiving servers identify and handle messages that fail authentication checks.

Without these records properly configured, messages sent from your domain may be marked as spam or rejected by receiving email providers.

In this doc, we'll cover the steps to add SPF, DKIM, and DMARC records to your domain.

To view our complete library of email documentation, click here.

Adding an SPF Record

The steps below will add a SPF record to your domain DNS, using a TXT record.

  1. Go to your DNS Records.
  2. Create a new TXT record by entering the following
  • Type: TXT
  • Name: @
  • TXT Value: v=spf1 include:_spf.hostedemail.com ~all
  • TTL: (default)

Note: Changes made to DNS records can take up to 24 to 48hrs to fully propagate.


DKIM Setup:

DKIM (Domain Keys Identified Mail) is an email authentication method intended to detect forged sender addresses in email. This is a technique often used in phishing and email spam. DKIM allows the recipient to check whether an email claimed to have come from a specific domain was indeed authorized by the owner of that domain.

To add DKIM to your domain, you will need to first generate the DKIM key and then add that key as a TXT record in your domains DNS:

  1. Generate a 1024 bit DKIM key. This can be done using a site such as: https://easydmarc.com/tools/dkim-record-generator

  2. For the Selector, you can use: key as the selector.

  3. Once the key is generated, next add the public key as a TXT record on the domain’s DNS zone file. You will need to add this record on a subdomain based on your key selector. For example: ‘key._domainkey.example.com’

  4. After adding the TXT record you will then add the full DNS entry value. The entry will look similar to this:v=DKIM1;t=s;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDSzwHEHkNw1IrmyYhshr3

    VWUZN1VLG8/vjFKpqoYpMN3jjKl2J0I/V2uEV5F5G6fbTCV0TRah7euOnciltFSVDnWBUDZR04itCifl1p

    w1/kF6z10hduyMXQ8K5VZGW9t6oovuC2D10rLn+Cx8yR/qeQqKvyDHIrHcXoJFCA5NOawIDAQAB


  5. Once this has been added to your DNS record, please send our support team an email and include the domain name, private key, as well as the domainkey selector, as we will need to add this information on our backend to complete the process.

Adding DMARC Record:

Microsoft now rejects some email sent to Outlook.com, Hotmail, Live, and MSN addresses when the sending domain does not have a DMARC record. This can happen even when your SPF and DKIM records are already set up correctly. Rejected messages are returned with an error like this:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records  

Adding a DMARC record to your domain’s DNS fixes this.

  1. Check your domain’s DNS Records for an existing DMARC record. If you already have a valid one, keep it. Do not add a second one or replace your existing policy.
  2. If you do not have one, open your DNS Records.
  3. Create a new TXT record with these values:
    • Type: TXT
    • Name: _dmarc
    • TXT Value: "v=DMARC1; p=none; sp=none; adkim=r; aspf=r;"  
    • TTL: default

Most DNS providers automatically add your domain to the Name field, so enter only _dmarc  .

If your provider requires the full name, use _dmarc.example.com  , replacing example.com with your domain.


Note: Changes made to DNS records can take up to 24 to 48hrs to fully propagate.