leadstoolpack

Home › How-tos › Email (SPF, DKIM, DMARC)

How to set up SPF, DKIM and DMARC so your emails land

Live guide · Checked 28 October 2026 · Updated 28 October 2026 · Checked every week against Email (SPF, DKIM, DMARC)'s own help pages

Add the three DNS records that prove your emails are really from you, so follow-ups and cold emails reach the inbox instead of spam.

Time
30 minutes
You will need
  • Access to your domain's DNS
  • Admin access to your email provider (Google Workspace, Microsoft 365, Zoho or similar)
  • A list of every service that sends email as your domain (your inbox, your CRM, your email tool)
Stuck?
Troubleshooting or ask us a question

Step by step

  1. List everything that sends as you

    Write down every service that sends email from your domain: your mailbox, CRM, newsletter tool and any cold-email tool. Each needs to be in your SPF record.

  2. Add one SPF record

    In DNS, add a TXT record on @ that starts v=spf1, lists each sender's include (your provider gives it, for Google it is include:_spf.google.com) and ends ~all. You can only have one SPF record per domain.

  3. Turn on DKIM

    In your email provider's admin, find DKIM (in Google Workspace: Apps > Google Workspace > Gmail > Authenticate email), generate a key and add the TXT record it gives you to DNS. Then press Start authentication.

  4. Do the same for your other senders

    Your CRM and email tools each have their own DKIM records. Add them all, so every email is signed.

  5. Add a DMARC record

    Add a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com. This starts in watch-only mode and sends you reports.

  6. Check it all passes

    Send an email to a Gmail address, open it, choose Show original and check SPF, DKIM and DMARC all say PASS.

  7. Tighten DMARC

    After two to four weeks of clean reports, change p=none to p=quarantine. Senders you forgot show up in the reports first, so fix them before you tighten.

  8. Use a separate domain for cold email

    Send cold outreach from a similar domain (for example getyourdomain.com) with its own SPF, DKIM and DMARC, so your main domain's reputation stays safe.

Tips from people who set these up every week

  • Google and Yahoo require SPF, DKIM and DMARC for anyone sending to their users in bulk, and an easy one-click unsubscribe on marketing email.
  • Too many includes in SPF (more than 10 lookups) breaks it. Remove services you no longer use.
  • Warm up a new sending domain slowly: a few emails a day, rising over three or four weeks.

Troubleshooting: questions and answers

Show original says SPF fail.

The service that sent it is not in your SPF record, or you have two SPF records. Merge them into one record starting v=spf1 that lists every sender.

DKIM says fail or none.

The DKIM record is missing or still pending. Check the TXT record name matches exactly what the provider gave you, then press Start authentication again.

My emails still go to spam.

Authentication is only the first step. Check you are not on a blocklist, keep complaints low, send to verified addresses and avoid link-heavy, image-only emails.

Official help pages

Let Claude fix the rest of your funnel

Lead Focus is 12 Claude Skills that find the stage of your funnel that's costing you leads, then fix it: ads, landing pages, follow-ups and tracking. One payment, free updates, and a 14-day refund.

Get Lead Focus · $29.99

Still stuck, or have a question?

Tell us where you got to and what you see. We read every message and reply by email, usually the same working day.