How to Set Up SPF, DKIM and DMARC: A Step-by-Step Guide

Why these three records matter

Every day, criminals send emails that look like they come from real UK businesses. They copy your name, your logo and your email address, then use that trust to trick a customer into paying a fake invoice or to talk a member of staff into moving money. This is the exact problem we covered in how to stop invoice fraud and email spoofing — and the practical fix is three small settings on your domain called SPF, DKIM and DMARC.

Think of them as the security features on a banknote. Individually, each is a clever trick. Together, they make forging your email extremely difficult. Best of all, they are free to set up — the only cost is a little care and patience.

This guide walks you through all three in plain English, in the right order, using a staged rollout that will not accidentally block your own emails.

The three records in one minute

Before the steps, here is what each one actually does:

• SPF (Sender Policy Framework) is a public list of the servers allowed to send email using your domain. If a message comes from a server that is not on the list, it fails SPF.
• DKIM (DomainKeys Identified Mail) adds an invisible, tamper-proof signature to every email you send. The receiving server checks the signature to confirm the message really came from you and was not altered in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instruction sheet. It tells other mail servers what to do when an email claiming to be from you fails SPF and DKIM — ignore it, quarantine it, or reject it outright. It also sends you reports so you can see who is using your domain.

You set them up in the order above, because DMARC only works properly once SPF and DKIM are in place.

What you need before you start

You will be adding records to your domain’s DNS — the settings that control how your domain behaves on the internet. You need:

• Access to your DNS provider (often your web host, your domain registrar, or a service like Cloudflare). If you do not know who this is, whoever built your website usually does.
• A list of every service that sends email as your business. This is the step people skip, and it causes most of the trouble. Write down your main email platform (for example Microsoft 365 or Google Workspace), plus anything else: your accounting software that emails invoices, your booking or CRM system, your newsletter tool, your website contact form.

Getting this list right now saves you from blocking your own emails later.

Step 1: Set up SPF

Your email provider publishes the correct SPF value for you — for Microsoft 365 it is a short line beginning with v=spf1. You add this as a single TXT record on your domain.

The golden rules:

• You may only have one SPF record per domain. If you already have one, edit it — do not add a second, or both break.
• Include every legitimate sender. Each provider gives you an include: snippet to add. So if you use Microsoft 365 and a separate invoicing tool, both must appear in the one record.
• End with -all (a hard fail) once you are confident the list is complete. Until then ~all (a soft fail) is a safer starting point.

A common mistake is exceeding the limit of ten lookups SPF allows. If you have many senders, your IT support can flatten or restructure the record so it stays valid.

Step 2: Set up DKIM

DKIM is switched on inside your email platform, which then gives you one or two records to publish in DNS.

In Microsoft 365, for example, you enable DKIM in the admin centre and it provides two CNAME records to add to your domain. Once those are live, you flip DKIM to on and your outgoing mail is signed automatically. Google Workspace works in a similar way, generating a key you publish as a TXT record.

Do the same for any other service that sends on your behalf — most newsletter and invoicing tools have a simple screen where you verify your domain, and DKIM is part of that.

There is nothing to maintain day to day once DKIM is on. The signing happens invisibly on every email.

Step 3: Turn on DMARC — but start gently

This is where care matters most. DMARC is a single TXT record, and its most important setting is the policy, written as p=. It has three levels:

• p=none — monitor only. Nothing is blocked; you simply receive reports.
• p=quarantine — failing messages go to spam or junk.
• p=reject — failing messages are refused and never delivered.

DMARC without staging is like changing the locks while people are still inside the building — do it in the wrong order and you lock out your own staff.

The safe path is to move through these in stages, never jumping straight to reject.

Stage 1: Start at p=none

Publish a DMARC record set to p=none and include a reporting address so the daily reports are sent to you (or to a monitoring service that turns them into readable summaries — the raw reports are XML files and hard to read by eye).

At this stage nothing changes for your recipients. You are quietly gathering evidence of every server sending email as your domain.

Stage 2: Read the reports and fix the gaps

Over the next two to four weeks, review the reports. You are looking for legitimate services that are failing SPF or DKIM — the invoicing tool you forgot, the CRM, the marketing platform. For each one, go back and add it to your SPF record or enable DKIM for it.

You will also see failed attempts from senders you do not recognise. Some of that is criminals spoofing you — which is exactly what DMARC will soon block.

Stage 3: Move to p=quarantine

Once your legitimate mail is passing cleanly, tighten the policy to p=quarantine. Now anything failing authentication lands in the recipient’s junk folder rather than their inbox. Keep watching the reports for a couple of weeks.

Stage 4: Move to p=reject

When you are confident every legitimate sender passes, set p=reject. This is full protection: forged emails claiming to be your domain are refused outright. This is the setting the NCSC recommends organisations aim for, and it is what genuinely shuts down domain spoofing.

Common mistakes to avoid

• Two SPF records. Only one is allowed. A second one silently breaks both.
• Jumping straight to p=reject. The single fastest way to block your own invoices and newsletters. Always stage it.
• Forgetting a sender. The accounting tool, the booking system, the contact form — if it sends mail as you, it needs SPF and DKIM sorted, or it will be rejected.
• Setting p=none and walking away. Monitoring mode protects nobody. It is a starting line, not a finish line. If you stop at none, criminals can still spoof you freely.
• Never reading the reports. The reports are the whole point of the staged approach. Ignoring them means you are guessing when to tighten the policy.

Where this fits in your wider defences

SPF, DKIM and DMARC stop criminals sending as your exact domain. They are essential, and they are also a required part of tightening up email fraud generally. But they are one layer. They do not stop lookalike domains, and they do not stop a fraudster who has stolen a real password.

That is why we pair email authentication with multi-factor authentication and staff training on spotting phishing. Together they form a proper defence rather than a single wall.

If reading DMARC reports and knowing when it is safe to reach p=reject feels like a job you would rather hand over, that is exactly the kind of work we do. Get in touch and we will set up all three records, monitor the reports and move you safely to full protection without ever blocking a legitimate email.