Most domains still get spoofed because nobody finished the job. Research from DMARCguard’s February 2026 scan of 5,499,028 domains found that 56.0% publish an SPF record and 30.4% publish DMARC, but only 12.8% actually enforce a policy that blocks spoofed mail, and DKIM lags furthest behind at 22.7% adoption, numbers that lined up with Guardian360’s April 2026 audit, which found 77.6% of analyzed domains still lack full spoofing protection. That gap persists even where regulators have pushed harder: France’s domain registry Afnic measured .fr SPF adoption climbing to only 69.0% in its September 2025 audit, up from 66.2% a year earlier, real progress, but still a third of domains unprotected in a market with some of the strictest data-protection enforcement in Europe. That gap is why Gmail, Yahoo, and Microsoft now treat SPF, DKIM, and DMARC as baseline requirements rather than nice-to-haves, and why a misconfigured record can silently drop your mail into spam or block it outright. This tutorial walks through setting up all three protocols correctly, from your first SPF record to a fully enforced DMARC policy at p=reject, with the exact DNS syntax, alignment rules, and troubleshooting steps you need in 2026, including what changed when RFC 9989, published in May 2026, replaced RFC 7489 as the DMARC specification.
By the end you’ll have a working, testable configuration: SPF authorizing your sending sources, DKIM cryptographically signing outbound mail, and DMARC telling receiving servers exactly what to do when a message fails. We’ll also cover how to read the aggregate (RUA) reports DMARC generates, since that data is what tells you whether it’s safe to move from monitoring to enforcement.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Why SPF, DKIM, and DMARC Matter More in 2026
Google’s bulk sender requirements, first enforced in February 2024, are now a fixed cost of doing business with Gmail. Any domain sending 5,000 or more messages a day to Gmail addresses must authenticate with both SPF and DKIM, publish a DMARC record of at least p=none, keep spam complaints under 0.3%, and support one-click unsubscribe on marketing mail. Yahoo mirrors these rules. Miss any of them and Google either rejects the message outright or routes it straight to spam, regardless of your sender reputation otherwise.
The compliance numbers show most organizations are still catching up, though the picture shifts depending on who’s measuring and when. A January 2026 analysis by UseTransactional found SPF adoption around 73% of domains, DKIM around 52%, and DMARC at just 16%, with only 6% of domains actually enforcing DMARC at p=quarantine or p=reject, a figure that lines up closely with MailMend’s own January 2026 audit, which put full p=reject enforcement at just 5.2% of domains and found that 39% still have no SPF record published at all, not far removed from Fortra’s August 2025 scan of 10 million domains, which found a valid SPF record on just 3,666,641 of them (36.7%), valid DMARC on 1,816,866 (18.2%), and full enforcement on only 755,281 (7.6%). Among active senders specifically, Unspam.email’s March 2026 testing found a much healthier SPF rate of 93% and DKIM at 90%, and technologychecker.io’s April 2026 measurement of message-level pass rates found 88.99% of emails pass DMARC, 90.90% pass DKIM, and 80.24% pass SPF, though 14.54% of analyzed traffic still fails SPF outright. In other words: publishing a record is common, but getting the configuration right so mail actually passes is where most teams stumble.
Google’s own Cloud Threat Horizons H1-2026 report frames strong sender authentication as part of a broader phishing defense stack, recommending phishing-resistant MFA using Titan Security Keys or FIDO2-compliant passkeys alongside authenticated email. Voice phishing and business email compromise remain leading attack vectors in 2026, and a spoofed “From:” address is still the cheapest way for an attacker to impersonate your domain. Getting SPF, DKIM, and DMARC configured correctly closes that door.
Prerequisites: What You Need Before You Start
This setup works with any DNS provider and any mail platform, but you’ll move faster if you have the following ready before Step 1:
- DNS zone access for the domain you’re authenticating (Cloudflare, Route 53, Google Domains successor registrars, GoDaddy, or your registrar’s default DNS panel all work).
- A complete list of everything that sends mail as your domain, your primary mailbox provider (Google Workspace, Microsoft 365), plus any marketing platform (Mailchimp, HubSpot, SendGrid), CRM, helpdesk, invoicing tool, or internal application that sends transactional email.
- Admin access to each of those sending platforms to retrieve their SPF include statements and DKIM public keys.
- A DKIM key generation tool, either your mail platform’s built-in generator (most ESPs provide one), or OpenSSL/OpenDKIM if you’re self-hosting mail via Postfix.
- A DMARC report parser or mailbox to receive and read aggregate (RUA) reports, a dedicated address like
[email protected], or a free/paid parsing service (Cloudflare, EasyDMARC, dmarcian, Postmark’s DMARC tool all offer free tiers). - Command-line access to run
digornslookupfor verifying DNS propagation. - Roughly 90 minutes for the initial setup, plus a monitoring window of 1â4 weeks before you move to full enforcement.
Nothing here requires a paid tool. SPF and DKIM are DNS TXT records you can publish for free with any registrar, and a monitoring-only DMARC policy costs nothing beyond the report parsing, which free tiers handle for domains under roughly 1,000â5,000 emails a day.
Step 1â3: Auditing and Publishing Your SPF Record
Step 1: Inventory every source that sends mail as your domain
SPF (Sender Policy Framework) is a DNS TXT record that lists every server and service authorized to send mail on behalf of your domain. The single biggest cause of SPF failures isn’t a syntax error, it’s an incomplete list. Before writing a single line of DNS, list every platform that sends mail using your domain in the “From:” address: your primary mailbox, marketing automation tools, transactional email APIs, help desk software, e-commerce platforms, and any internal script or cron job that emails customers.
Each of these platforms publishes its own SPF “include” mechanism you’ll add to your record. Google Workspace uses include:_spf.google.com, Microsoft 365 uses include:spf.protection.outlook.com, SendGrid uses include:sendgrid.net, and so on, check each vendor’s authentication documentation for the exact string, since these values do change.
Step 2: Write the SPF record
An SPF record is a single TXT record on your root domain. It starts with v=spf1, lists your authorized senders, and ends with a qualifier that tells receivers what to do with mail from unlisted sources. Here’s an example combining Google Workspace and SendGrid:
v=spf1 include:_spf.google.com include:sendgrid.net -allThe -all at the end is a “hard fail”, it tells receiving servers to reject mail from any source not explicitly listed. During initial rollout, many teams start with ~all (soft fail, mail is accepted but flagged) to avoid breaking deliverability while they finish the audit from Step 1, then tighten to -all once they’re confident the list is complete.
Watch your total DNS lookup count here. SPF caps out at 10 total “mechanism” lookups (each include, a, mx, ptr, and redirect counts). Exceed 10 and receiving servers return a permerror and treat your SPF as failed entirely, even if the syntax is otherwise valid. If you have more than a handful of sending sources, flatten your includes into fewer overall lookups or use a dedicated SPF flattening service.
Step 3: Publish the record and verify it resolves
Log into your DNS provider and add a TXT record on the root of your domain (host value is usually @) with the SPF string as the value. Use a TTL of 3600 seconds (1 hour) so you can iterate quickly during setup, and raise it to 86400 once the record is stable.
Verify propagation with dig:
dig +short TXT yourdomain.com | grep spf1Expected output:
"v=spf1 include:_spf.google.com include:sendgrid.net -all"If nothing returns after 15â30 minutes, double-check you didn’t accidentally create a second TXT record on a subdomain, or that a wildcard record elsewhere in your zone isn’t shadowing it. A domain can only have one SPF record; if a legacy record already exists, merge the includes into it rather than adding a second TXT record, since multiple SPF records cause a permanent SPF failure.
Step 4â6: Generating and Publishing DKIM
Step 4: Generate a DKIM key pair
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outbound message, letting the receiving server verify the mail wasn’t altered in transit and genuinely originated from a server holding your private key. Most hosted platforms, Google Workspace, Microsoft 365, SendGrid, Mailchimp, generate and manage the key pair for you inside their admin console; you just publish the public key they give you.
If you’re self-hosting mail with Postfix and OpenDKIM, generate the key pair manually:
sudo mkdir -p /etc/opendkim/keys/yourdomain.com
cd /etc/opendkim/keys/yourdomain.com
sudo opendkim-genkey -b 2048 -d yourdomain.com -s mail2026
sudo chown opendkim:opendkim mail2026.private
cat mail2026.txtUse a 2048-bit key, not 1024-bit, since 1024-bit DKIM keys are increasingly rejected or flagged by major mailbox providers as insufficient. An October 23, 2026 IETF draft points the same way: it rejects RSA-SHA1 and RSA keys shorter than 1,024 bits and recommends RSA keys of at least 2,048 bits or Ed25519, though that is draft guidance rather than a new DKIM release. The -s mail2026 flag sets your DKIM selector, an arbitrary label that lets you rotate keys later without breaking the DNS record name. Naming it by year (mail2026) makes annual rotation straightforward.
Step 5: Publish the DKIM selector record
DKIM publishes as a TXT record at selector._domainkey.yourdomain.com, not on the root domain. The mail2026.txt file generated above contains the exact record to publish, formatted roughly like this:
mail2026._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." )Add this as a TXT record with the host value mail2026._domainkey (your DNS provider automatically appends your domain). The p= value is your public key, keep the private key file secure and never publish it anywhere. Verify with:
dig +short TXT mail2026._domainkey.yourdomain.comStep 6: Enable DKIM signing on your mail server or ESP
Publishing the DNS record alone doesn’t sign anything, you also need to turn on signing at the sending end. In Google Workspace, this is under Admin Console â Apps â Google Workspace â Gmail â Authenticate email, where you generate the key and Google both creates the DNS value and starts signing automatically once you confirm the record is live. In Microsoft 365, it’s the reverse: Microsoft signs with a default selector automatically, and you need to explicitly enable a custom DKIM signing configuration in the Defender portal if you want your own selector instead of the default *.onmicrosoft.com one.
For self-hosted Postfix with OpenDKIM, add these lines to /etc/opendkim.conf and restart the service:
Domain yourdomain.com
KeyFile /etc/opendkim/keys/yourdomain.com/mail2026.private
Selector mail2026
Socket inet:8891@localhost
sudo systemctl restart opendkim postfixSend a test message to a Gmail or Yahoo test mailbox and check the message headers (“Show original” in Gmail) for dkim=pass. If it reads dkim=none, signing isn’t active yet; if it reads dkim=fail, the DNS record and the private key don’t match, usually because the record didn’t finish propagating, or because you copy-pasted the public key with a line break or stray character.
Step 7â9: Building and Publishing DMARC
Step 7: Understand DMARC alignment before writing the record
DMARC (Domain-based Message Authentication, Reporting and Conformance) doesn’t do its own authentication, it sits on top of SPF and DKIM and tells receivers what to do when a message fails both, and it publishes a reporting address so you can see what’s happening across your entire mail flow. A message passes DMARC if it passes SPF and is aligned, or passes DKIM and is aligned (only one of the two is required, not both). The core protocol is now specified in RFC 9989, published in May 2026, which obsoleted RFC 7489, and existing DMARC records remain valid under it.
Alignment is the part most guides skim past and most failures trace back to. The aspf tag controls SPF alignment and adkim controls DKIM alignment, each set to strict (s) or relaxed (r, the default). In strict mode, the domain in your DKIM signature’s d= tag or your SPF envelope-from must exactly match the domain in the visible “From:” header. In relaxed mode, it just needs to be an organizational match, a subdomain like mail.yourdomain.com aligns fine with a From: header of yourdomain.com. If you route email through a third-party ESP that signs with its own domain in d=, strict alignment will fail even though DKIM technically validated, this is the single most common “why is DMARC failing when SPF and DKIM both pass” support ticket.
Google’s bulk sender guidance specifically calls out that for high-volume senders, both SPF and DKIM alignment should be configured, relying on SPF alone with DMARC but no DKIM can still trip compliance checks even though DMARC technically only requires one to pass.
Step 8: Write and publish the DMARC record, starting at p=none
Never launch straight into enforcement. Every serious DMARC rollout guide, including Google’s own bulk sender requirements, recommends starting at p=none, a monitoring-only policy that changes nothing about delivery but starts generating aggregate reports so you can see every sending source touching your domain before you start blocking anything. Microsoft guidance updated October 23, 2026 follows the same sequence: publish a DMARC TXT record at _dmarc beginning with p=none, review the reports, and only then consider p=quarantine and p=reject.
Publish this as a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:[email protected]; pct=100; adkim=r; aspf=r; fo=1Breaking down each tag:
p=none, policy: monitor only, don’t affect delivery yet.rua=mailto:..., where daily aggregate reports get sent. Use a dedicated inbox, not a personal mailbox, since these reports arrive as gzipped XML attachments and pile up fast.pct=100, apply the policy to 100% of mail (leave this at 100 while monitoring; it only matters once you’re enforcing). RFC 9989 removed thepcttag from the specification in May 2026, so older records that carry it are the main place you will still see it.adkim=r/aspf=r, relaxed alignment, the safer default while you’re still discovering your full sending footprint.fo=1, generates forensic-style failure reporting whenever either SPF or DKIM fails, giving you more granular data during the audit phase.
Step 9: Verify the record and confirm reports start arriving
Check propagation the same way as before:
dig +short TXT _dmarc.yourdomain.comWithin 24â48 hours, major receivers (Google, Microsoft, Yahoo) will start sending daily aggregate reports to your rua address. If nothing arrives after 3â4 days, confirm the mailbox exists and isn’t filtering the reports as spam, gzip XML attachments from unfamiliar senders sometimes get flagged by aggressive spam filters, which is mildly ironic given the context.
How the Revised DMARC Specification Affects Your Record
In May 2026 the IETF published the revised DMARC specification as three documents: RFC 9989 (core), RFC 9990 (aggregate reports) and RFC 9991 (failure reports). DMARC is now a Proposed Standard, and the set obsoleted RFC 7489, the document most older tutorials still cite. “DMARCbis” was the working name for the revision that became RFC 9989, not a new DNS-record version or a separate product.
Several tags changed. The pct, rf and ri tags are gone, t= and np= are standard, and the Public Suffix List is out. DMARCbis also introduced or standardized the psd tag, and it replaced reliance on the Public Suffix List with an upward DNS “tree walk” for organizational-domain discovery. Existing DMARC records remain valid, and available guidance does not indicate an emergency migration requirement, so the record you just published does not need to be torn down.
For you, the practical result is that the rollout order stays the same: publish at p=none, read the reports, and move to quarantine and then reject only when every legitimate source passes. Because the pct tag is no longer part of the specification, treat the staged values in Step 12 as a cautious rollout aid and check your reports closely after each p= change. When you document your setup internally, cite RFC 9989 for the core protocol, RFC 9990 for aggregate reports and RFC 9991 for failure reports instead of RFC 7489.
Step 10â12: Reading Reports, Fixing Gaps, and Enforcing
Step 10: Parse aggregate (RUA) reports
Aggregate reports, which RFC 9990 now defines (RFC 9991 covers failure reports), arrive as gzipped XML, one file per receiving mailbox provider per day. They’re not human-readable at scale, so most teams either use a free parsing dashboard (Cloudflare’s built-in DMARC management, EasyDMARC’s free tier, or Postmark’s DMARC digests) or write a quick script. Here’s a minimal Python parser that extracts the source IP, pass/fail counts, and disposition from a single report:
import gzip
import xml.etree.ElementTree as ET
with gzip.open("google.com!yourdomain.com!1755648000!1755734400.xml.gz") as f:
tree = ET.parse(f)
for record in tree.findall(".//record"):
ip = record.find("row/source_ip").text
count = record.find("row/count").text
disposition = record.find("row/policy_evaluated/disposition").text
dkim = record.find("row/policy_evaluated/dkim").text
spf = record.find("row/policy_evaluated/spf").text
print(f"{ip:15} count={count:>4} disposition={disposition:<8} dkim={dkim} spf={spf}")Example output:
209.85.220.41 count=1284 disposition=none dkim=pass spf=pass
198.2.180.13 count= 47 disposition=none dkim=fail spf=pass
40.107.65.72 count= 312 disposition=none dkim=pass spf=fail
203.0.113.9 count= 3 disposition=none dkim=fail spf=failThat third line, a source you don't recognize sending 312 messages that pass DKIM but fail SPF, is exactly the kind of gap monitoring mode is built to catch. It might be a legitimate marketing tool you forgot to add to your SPF record, or it might be an unauthorized source. Either way, you don't want to discover it after flipping to p=reject.
Step 11: Fix alignment gaps and add missing senders
For every unrecognized or failing source in your reports, do one of three things: add it to your SPF include list if it's legitimate, configure DKIM signing for that platform if it supports it, or investigate it as unauthorized use of your domain if you can't identify it. Run this cycle for at least one to two full weeks, long enough to capture weekly newsletter sends, monthly invoice runs, and any other low-frequency mail that daily monitoring might miss in a shorter window.
Step 12: Move to quarantine, then reject
Once your reports show consistent pass rates, most practitioners look for several consecutive days above roughly 98% pass across all known sources, step up enforcement gradually rather than jumping straight to full rejection:
# Stage 1: quarantine 25% of failing mail
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]; adkim=r; aspf=r
# Stage 2: quarantine 100% of failing mail
v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; adkim=r; aspf=r
# Stage 3: full enforcement
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; adkim=r; aspf=rKeep watching aggregate reports at every stage, the pct tag lets you dial the blast radius up gradually so a missed sending source causes a partial delivery problem instead of a total outage, although RFC 9989 removed pct from the specification in May 2026, so the dependable safeguard is moving one p= level at a time while you read every report. Most teams spend two to four weeks moving from none to full reject. Rushing this is the single most common way DMARC rollouts break legitimate mail, and it's exactly why EasyDMARC's 2026 adoption report found that more than half of domains publishing DMARC are still stuck at p=none years after adoption, teams turn on monitoring, get busy, and never finish the job.
SPF vs DKIM vs DMARC: Quick Comparison
| Protocol | What it checks | Where it's published | Failure result without DMARC |
|---|---|---|---|
| SPF | Is the sending IP authorized for this domain? | TXT record on root domain | Mail may still deliver, often flagged |
| DKIM | Was the message cryptographically signed by the domain owner? | TXT record at selector._domainkey subdomain | Mail may still deliver, integrity unverified |
| DMARC | Do SPF or DKIM align with the visible From: address, and what should receivers do if not? | TXT record at _dmarc subdomain | N/A: DMARC defines the enforcement action itself |
2026 Email Authentication Adoption: How Far Behind Is Everyone?
If you're wondering whether it's worth the effort, the adoption data says most of your competitors haven't finished either, which is exactly why attackers still find spoofing profitable. EasyDMARC's own longitudinal tracking, which reviewed 1.8 million domains, already put DMARC adoption among top domains at 47.7% by July 2025, and Warmforge's follow-up study of that same 1.8-million-domain pool found adoption had climbed to 52.1% by July 2026, though not every tracker agrees the trend is purely upward: Unspam.email's March 2026 sample actually measured DMARC adoption falling to 48%, down from 59% in 2025, a reminder that records can lapse or get misconfigured just as easily as they get added. Country-code registries tell a steadier story: Afnic's September 2025 audit of .fr domains found DKIM adoption up to 40.7% from 28.5% a year earlier, and DMARC adoption rising to 19.5% from 15.1%, smaller absolute numbers than the global trackers, but a consistent year-over-year gain rather than the flat-to-falling picture some global samples show. Numbers vary by study and sample size, but the direction is consistent across every 2026 report:
| Source | Sample | SPF adoption | DKIM adoption | DMARC adoption | DMARC at full enforcement |
|---|---|---|---|---|---|
| DMARCguard (Feb 2026) | 5.49M domains | 56.0% | 22.7% | 30.4% | 12.8% enforce any policy |
| UseTransactional (Jan 2026) | General domains | ~73% | ~52% | ~16% | ~6% at quarantine/reject |
| EasyDMARC Adoption Report | Global, top 5,000 | - | - | 76.2% (top 5,000) | 15.2% at p=reject (top 5,000) |
| ShowMyIP (May 2026) | 288 major public domains | - | - | 99.3% | 67.7% at p=reject |
| SecurityToday.de (Apr 2026) | Top domains | 93% | 90% | 64% | 4% at strictest reject policy |
The pattern across every one of these studies: well-resourced, high-profile domains get close to full SPF and DKIM coverage, but DMARC enforcement, the step that actually stops spoofing, stays in the single digits to low twenties even among large, well-known organizations. DMARCDKIM.com's December 2025 scan put a number on that gap, finding 71.5% of domains still lack effective DMARC protection even as it counted 77,333 domains worldwide that had reached fully enforced p=reject policies. The one clear exception is the Fortune 500: EasyDMARC's 2026 report found 95% of Fortune 500 companies now publish DMARC, with 62.7% already at full p=reject enforcement as of April 2026, proof that enforcement is achievable once security teams treat it as a priority rather than a checkbox. That gap against the broader internet is stark, Fortra's August 2025 audit of 10 million domains found only 755,281 (7.6%) had reached any enforcement at all, underscoring just how far ahead large, well-resourced brands are of the median domain. Publishing a record is the easy 20%. Reading reports and tightening the policy is the harder 80% that most teams never finish.
How Gmail, Microsoft 365, and Yahoo Handle Authentication Differently
The three protocols are standardized, but how each mailbox provider evaluates and enforces them varies enough to matter when you're troubleshooting a specific delivery problem. Google's Postmaster Tools dashboard is the most transparent option available to senders, it shows domain and IP reputation, spam rate, authentication pass rates, and delivery errors specifically for Gmail, broken out by day. If your DMARC aggregate reports show Google-sourced failures you can't explain from the XML alone, Postmaster Tools usually fills in the missing context, since it surfaces reputation signals that aggregate reports don't include.
Microsoft 365 and Outlook.com evaluate authentication through the Exchange Online Protection stack, and Microsoft's own composite authentication result (visible in message headers as compauth) sometimes overrides a technical SPF or DKIM pass if other reputation signals look suspicious, meaning a message can show spf=pass; dkim=pass in the raw headers yet still get flagged, because Microsoft's spam filtering layer sits on top of, not instead of, the DMARC evaluation. This is a common source of confusion for teams who assume "authentication passed" means "delivery guaranteed."
Yahoo (and AOL, which shares Yahoo's mail infrastructure) generally mirrors Google's bulk sender requirements but has historically been slower to publish detailed reporting tools for senders, so most teams rely on the aggregate reports Yahoo sends to your rua address as the primary visibility source rather than a dedicated postmaster dashboard. If you're seeing inconsistent results specifically from Yahoo/AOL addresses while Gmail and Outlook pass cleanly, double-check that your SPF include list and DKIM selector are both correctly scoped for any ESP-specific IP ranges Yahoo might evaluate more strictly.
The practical takeaway: use DMARC aggregate reports for the broad picture across all three, but pull in Google Postmaster Tools specifically when you need to debug a Gmail-only problem, since it's the one venue that shows reputation data DMARC reports don't capture.
Common Pitfalls When Setting Up SPF, DKIM, and DMARC
- Publishing two SPF records instead of merging one. Multiple TXT records starting with
v=spf1on the same domain cause an automatic SPF permerror. Always merge every sending platform into a single record. - Exceeding the 10-lookup SPF limit. Each nested
includecounts toward the cap, and some vendor includes nest three or four levels deep on their own. Flatten aggressively if you use more than 3â4 major platforms. - Jumping straight to p=reject on day one. Without a monitoring period, you will not know about the invoicing tool that's been sending as your domain for two years until it silently starts bouncing.
- Ignoring DKIM alignment when using a third-party ESP. If your email service provider signs with its own
d=domain instead of yours, DKIM alignment fails under strict mode even though the signature itself validates fine. Confirm your ESP supports custom-domain DKIM signing, not just their own. - Forgetting subdomains. DMARC policy on the root domain doesn't automatically cover mail sent from subdomains unless you also account for them, either with a subdomain policy tag (
sp=) or by explicitly authenticating each subdomain that sends mail. - Letting the DMARC report mailbox go unread. Publishing
rua=and never opening the reports means you're generating data nobody looks at, the entire value of the monitoring period depends on someone actually reviewing it weekly. - Copy-pasting DKIM public keys with line breaks. DNS TXT record UIs sometimes wrap long strings, and a stray newline inside the
p=value breaks the key even though it looks fine visually. Always verify withdigafter publishing.
Troubleshooting SPF, DKIM, and DMARC Failures
| Symptom | Likely cause | Fix |
|---|---|---|
| SPF returns "permerror" | More than 10 DNS lookups in the SPF chain, or two competing SPF records | Flatten includes; merge duplicate records into one |
| SPF passes but DMARC still fails | SPF envelope-from domain doesn't match the visible From: header (alignment failure) | Switch to relaxed alignment (aspf=r) or ensure envelope-from matches your domain |
| DKIM shows "neutral" or "none" in headers | Signing isn't enabled on the sending platform even though the DNS record is published | Enable DKIM signing in your ESP/mail server admin panel, not just the DNS record |
| DKIM shows "fail" specifically | Public key in DNS doesn't match the private key signing the message, often from a copy-paste error | Regenerate the key pair and re-publish cleanly, verify with dig before re-testing |
| DMARC aggregate reports never arrive | Report mailbox doesn't exist, or reports are being filtered as spam/junk | Confirm the mailbox is active; whitelist known reporting senders like Google and Microsoft |
| Legitimate mail starts bouncing after moving to p=quarantine | Enforcement was turned on before the monitoring period surfaced every sending source | Roll back to p=none temporarily, extend monitoring, then re-attempt enforcement once every legitimate sending source is accounted for |
| DKIM alignment fails only for ESP-sent mail | ESP signs with its own domain (d=esp.com) instead of yours | Configure custom-domain DKIM signing in the ESP's settings if supported |
| New DNS record not resolving after 24 hours | Wrong host field (missing subdomain like _dmarc or selector._domainkey), or TTL caching an old response | Double-check the exact host value required and query an authoritative nameserver directly |
| Gmail still routes authenticated mail to spam | Authentication passing doesn't guarantee sender reputation or spam-complaint thresholds are met | Check spam complaint rate stays under 0.3% per Google's bulk sender requirements, review content and sending volume ramp |
Advanced Tips for Enterprise Email Authentication
Once basic SPF, DKIM, and DMARC enforcement is stable, a few refinements matter more for larger or higher-risk domains:
- Rotate DKIM keys annually. Naming your selector by year (as in the
mail2026example above) makes rotation a matter of publishing a new selector, switching signing over, and letting the old one expire after a grace period rather than a risky in-place key swap. - Use strict alignment once you're confident in your setup. Relaxed alignment (
r) is the safer starting point, but strict alignment (s) closes a narrower spoofing window where an attacker registers a subdomain that technically aligns under relaxed rules. - Separate subdomain policy with
sp=. If your root domain enforcesp=rejectbut you have non-sending subdomains, an explicitsp=rejecttag blocks spoofed mail claiming to come from a subdomain you never configured to send at all, a common phishing tactic that pure root-domain enforcement misses. - Add BIMI once DMARC is at full enforcement. Brand Indicators for Message Identification requires
p=quarantineorp=rejectas a prerequisite, and rewards you with your logo displayed next to authenticated mail in supporting inboxes like Gmail and Yahoo, a visible trust signal for recipients, though it typically also requires a Verified Mark Certificate. - Layer in phishing-resistant MFA for the humans, not just the domain. Google's Cloud Threat Horizons H1-2026 report pairs strong email authentication with FIDO2 passkeys and hardware security keys for account access, since a spoofed email is often just the first step toward a credential phishing attempt, not the end goal.
- Automate report ingestion instead of reading raw XML. At any real sending volume, manually parsing gzipped aggregate reports doesn't scale, pipe them into a dashboard (Cloudflare's free DMARC management, dmarcian, EasyDMARC, or an internal parser like the Python example above feeding a database) so trends are visible over weeks, not just single days.
Complete Working Example: DNS Records for a Small Business Domain
Here's a full, consistent set of records for a hypothetical domain, examplecorp.com, using Google Workspace for primary mail and SendGrid for transactional email, at the final enforcement stage after a completed monitoring period:
# SPF, root domain TXT record
examplecorp.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"
# DKIM, Google Workspace selector (values provided by Google Admin Console)
google._domainkey.examplecorp.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhki..."
# DKIM, SendGrid selector (values provided by SendGrid dashboard)
s1._domainkey.examplecorp.com. TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb..."
# DMARC, full enforcement after monitoring period
_dmarc.examplecorp.com. TXT "v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=r; aspf=r; sp=reject"This configuration authorizes exactly two sending sources, cryptographically signs mail from both, rejects anything that fails alignment on either check, and extends that rejection to any subdomain of examplecorp.com that isn't explicitly authorized. It's the end state most guides are working toward, the difference is getting there through a deliberate, monitored rollout instead of publishing this on day one and hoping nothing breaks.
Testing Your Complete Setup
Before declaring victory, run through this checklist:
- Send a test email to a Gmail test account and open "Show original", confirm
spf=pass,dkim=pass, anddmarc=passall appear in the Authentication-Results header. - Send from every platform on your inventory list from Step 1, not just your primary mailbox, marketing tools and transactional APIs need separate verification.
- Query all three records directly to confirm they're live:
dig +short TXT yourdomain.com,dig +short TXT selector._domainkey.yourdomain.com, anddig +short TXT _dmarc.yourdomain.com. - Check your DMARC aggregate reports for at least a full week showing consistent pass rates before increasing
pct=or tightening the policy further. - Re-test after any change to your mail sending infrastructure, adding a new marketing tool or switching CRM providers means updating SPF includes and DKIM signing before that tool goes live, not after.
Frequently Asked Questions
Do I need SPF, DKIM, and DMARC all three, or just one?
You need all three to be fully protected. SPF and DKIM are the underlying authentication checks; DMARC is the policy layer that tells receivers what to do when those checks fail and gives you visibility through reporting. DMARC without SPF or DKIM configured underneath it has nothing to evaluate.
How long does the full rollout take?
Initial DNS setup for SPF and DKIM takes under an hour for a single mail platform. The full journey from p=none monitoring to p=reject enforcement typically takes two to four weeks, since you need to observe at least one full billing/reporting cycle to catch low-frequency senders like monthly invoices or quarterly newsletters.
Will this break my existing email deliverability?
Not if you follow the monitoring-first approach. Starting at p=none changes nothing about delivery, it only generates reports. The risk of breakage comes specifically from skipping monitoring and jumping straight to p=reject, which is why every major vendor's guidance, including Google's own bulk sender documentation, recommends the gradual rollout.
What's the difference between p=none, p=quarantine, and p=reject?p=none takes no action and only reports; p=quarantine tells receivers to route failing mail to spam/junk; p=reject tells receivers to block failing mail outright before it reaches the inbox. Most rollouts move through all three stages in order.
Do I need a paid tool to read DMARC reports?
No. Free tiers from Cloudflare (if your DNS is hosted there), EasyDMARC, and dmarcian handle typical small-business volumes. You can also parse the raw XML yourself with a short script, as shown in Step 10, if you want full control over the data.
My DKIM signature passes but DMARC still fails, why?
This is almost always an alignment issue, not a signature issue. Check whether the domain in your DKIM signature's d= tag matches your visible "From:" domain under your chosen alignment mode (strict requires an exact match; relaxed allows a subdomain match).
Does DMARC apply automatically to subdomains?
Not fully. By default, subdomains inherit the root policy unless you set a separate sp= tag, but subdomains that never send mail at all still need to be covered, otherwise they become an unmonitored gap an attacker can spoof from.
Is this required for Gmail and Yahoo, or just recommended?
For any domain sending 5,000 or more messages a day to Gmail addresses, it's a hard requirement under Google's bulk sender rules, messages that fail get rejected or routed to spam. For lower-volume senders it's not strictly enforced the same way, but it still materially affects inbox placement and protects against domain spoofing regardless of volume.
What happens to a domain that never sends email at all?
It still needs protection. Parked or non-sending domains are a favorite target for spoofing precisely because nobody's watching them, attackers register lookalike sending infrastructure and use your dormant domain's name in the From: header since there's no legitimate mail to compare against. Publish an SPF record of v=spf1 -all (authorizing nothing) and a DMARC record of v=DMARC1; p=reject; rua=mailto:[email protected] on every domain you own, even ones that will never send a single message, to close off that spoofing vector entirely.
For more cybersecurity setup guides, see the cybersecurity threats and defense hub.
Sources: Microsoft Learn, Set up DMARC to validate email in Microsoft 365, Google Workspace Admin Help, Set up DMARC, GMass, Gmail Bulk Sender Guidelines 2026, IETF RFC 7489, DMARC specification (the older specification, obsoleted in May 2026 by RFC 9989, with RFC 9990 for aggregate reports and RFC 9991 for failure reports), DMARC.org, Protocol overview.
