What Are SPF, DKIM and DMARC and How Do You Set Them Up? A 10/10 Email Test Score

No matter how well your email is written, the recipient's server first looks for the answer to one question: Is this message really coming from where it claims to? Three DNS records answer that question: SPF, DKIM and DMARC. When they are missing or wrong, even your most carefully crafted newsletter can end up in the spam folder.

The English source lesson describes this topic as "a bit boring, but you do it once and it's done". The lesson aims for a score of 10 out of 10 in free test tools after setting up the records. We set the same goal, but we also explain what each record does and add the important details the lesson skips.

In this guide we explain step by step what SPF, DKIM and DMARC records are, how to set them up using Google Workspace as an example, how newsletter services work with these records and which tools you can use to test your setup.

This article is the seventh part of our Making Money Online and Email Marketing Guide series. In the previous part we covered setting up email with your own domain and the basics of your sending infrastructure.

What's in this guide?

1. Why are SPF, DKIM and DMARC needed?
2. How do you set up an SPF record?
3. How do you set up DKIM?
4. How do you set up DMARC?
5. How do you test the setup? The 10/10 score
6. Sample DNS table
7. Common mistakes
8. Conclusion and the next part of the series

Why are SPF, DKIM and DMARC needed?

When email was first designed, there was no way to verify the sender's identity; anyone could send a message from someone else's address. These three records were developed to close that gap. Here's an analogy:

• SPF is the list of authorised postmen at the door: only the servers on the list may send email on behalf of your domain.
• DKIM is the seal on the envelope: it proves the message was sent by you and wasn't changed on the way.
• DMARC is the instruction given to the doorkeeper: it says what to do if a message arrives from someone not on the list or with a broken seal, and it sends you reports.

According to Google's sender guidelines, every sender must use at least SPF or DKIM, and those sending 5,000 or more messages a day to Gmail accounts must set up all three: SPF, DKIM and DMARC. Even if your volume is small, setting up all three makes your emails look trustworthy.

How do you set up an SPF record?

An SPF record is a TXT record added to your domain's DNS settings. According to Google Workspace's SPF guide, if you send email only with Google Workspace, the record is:

v=spf1 include:_spf.google.com ~all

The "include" part of the record shows the authorised sending servers. The "~all" at the end says that messages from servers not on the list should be treated as suspicious; Google recommends this setting. The stricter "-all" asks for messages not on the list to be rejected outright.

If you use more than one service

Your business email may be on Google Workspace, your newsletter on a separate service and your invoices sent from accounting software. In that case you don't add a new SPF record; you extend the existing one. One of Google's examples is for people who use Google Workspace and Mailchimp together:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Pay attention to two rules:

• A domain should have only one SPF record. When there are two separate "v=spf1" records, receiving servers treat SPF as invalid.
• SPF allows at most 10 DNS lookups. Every "include" triggers extra lookups; if you add too many services, the record can exceed the limit and SPF will fail.

Some newsletter services handle bounced emails through their own domain, so they run the SPF check on their own domain. In that case you pass DMARC with your DKIM signature. Follow the instructions on your service's domain verification screen.

How do you set up DKIM?

DKIM works with a key pair. The private key stays on your provider's server and signs every outgoing message. The public key is published in your DNS; receiving servers check the signature with this key.

DKIM in Google Workspace

According to Google's DKIM guide, the steps are:

1. In the Admin Console, go to the email authentication settings and select your domain.
2. Choose the key length: 2048-bit if your domain provider supports it, otherwise 1024-bit.
3. Copy the name of the generated TXT record (the selector prefix and "._domainkey") and its value in the form "v=DKIM1; k=rsa; p=...".
4. Add this record to your domain's DNS settings.
5. Once the record has propagated, go back to the Admin Console and start DKIM signing.

DKIM in your newsletter service

When you add your sending domain in MailerLite, Brevo or Mailchimp, the service gives you its own DKIM records; these are usually CNAME records. Once you add them too, your newsletters are signed on behalf of your own domain. A domain can have several DKIM records with different selectors; the single-record rule of SPF doesn't apply to DKIM.

To see which selector is being used, send yourself a test email and look at the "s=" value in the "DKIM-Signature" line of the message source.

How do you set up DMARC?

A DMARC record is a TXT record added with the name "_dmarc". The simplest starting record is:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• p (policy): "none" takes no action and only requests reports. "quarantine" sends messages that fail authentication to the spam folder. "reject" asks for those messages to be rejected.
• rua: The address where daily aggregate reports are sent. Google recommends always including this tag.
• pct: Specifies the percentage of messages the policy applies to; useful when tightening the policy gradually.

The detail the lesson skips: reports

In the lesson, the DMARC record is created with a record generator using a "none" policy, and the reporting part is ignored. Yet the real value of DMARC lies in its reports: they tell you which servers send email on behalf of your domain, which ones fail authentication and whether someone is trying to impersonate your domain. The reports arrive in XML; you can make them readable with the report tools on sites like MxToolbox and mail-tester.

Tighten the policy gradually

How do you test the setup? What a 10/10 score means

After adding the records, check that everything works with a few free tools. DNS changes can take up to 48 hours to propagate everywhere; if a test fails, try again later.

• AppMailDev DKIM test: Gives you a test address; when you send an email to it, it creates a report with SPF, DKIM, DMARC, reverse DNS and blacklist results.
• MxToolbox: Looks up your domain's SPF, DKIM and DMARC records and checks whether your server is on any blacklists. The DMARC record generator used in the lesson is also on this site.
• mail-tester: Gives you an address; when you send one of your real emails to it, it scores your settings and content out of 10. It is available in several languages.
• "Show original" in Gmail: In a message you send to your own Gmail address, you should see "PASS" on the SPF, DKIM and DMARC lines.
• Google Postmaster Tools: If you send to Gmail regularly, you can monitor your domain's spam complaint rate here.

What a 10/10 means and what it doesn't

In the lesson, a 10/10 is achieved on mail-tester and the content warnings are dismissed as "not important". A 10/10 shows your technical settings are correct, but it doesn't guarantee your email will reach the inbox. When deciding on delivery, providers also look at the quality of your list, how subscribers engage with your emails and your complaint rate. Take the content warnings seriously too: broken links, image-only emails and exaggerated sales language lower your score.

Sample DNS table

For examplebrand.com, which uses business email with Google Workspace and sends its newsletter through a separate email marketing service, the records look roughly like this:

Always copy the values from your own provider's panel; the table here only shows the layout.

Common mistakes

• Adding a separate SPF record for every new service
• Adding too many "include"s to the SPF record and exceeding the 10-lookup limit
• Adding the DKIM record to DNS but forgetting to start signing in the provider's panel
• Setting up DMARC without a report address
• Moving to the "reject" policy without checking all sending sources
• Ignoring the content warnings after getting a 10/10

Conclusion: three records, set up correctly once

SPF sets the authorised servers, DKIM the integrity of the message and DMARC what to do with messages that break the rules. When all three are set up correctly, your domain is protected against impersonators and your emails are more likely to reach the inbox. Remember the single SPF record rule, set up DKIM separately for each sending service and tighten DMARC gradually by reading the reports.

What's in part eight of the series?

Once the technical infrastructure is ready, it's time to build your new domain's reputation gradually. In the next part we explain the email warm-up process, how to increase your sending volume and why some of the shortcuts taught in the lesson don't work. You can follow the TurkWebsite blog for our other articles.

Note: Providers' screens and recommendations may change over time; always follow your provider's current instructions when adding records. Last updated: 3 November 2026.