What SPF, DKIM and DMARC each do
SPF lists the servers allowed to send for your domain; DMARC tells receiving servers what to do when SPF and DKIM fail. Publish SPF as one TXT record at the root, DKIM at its selector, then DMARC at _dmarc.example.com starting with p=none. Move to quarantine, then reject, after the reports look clean.
All three are DNS records. None of them is set inside your mail client, and none of them changes how a mailbox behaves. They tell the receiving server what to check and what to do with the result.
| Record | Host name | Job | Example value |
|---|---|---|---|
| SPF | @ (the domain root) | Lists the servers and services allowed to send mail | v=spf1 include: |
| DKIM | selector. | Signs each message so the receiver can verify it was not altered | v=DKIM1; k=rsa; p=MIIBI |
| DMARC | _dmarc | Sets the policy when SPF or DKIM fails, and sends reports | v=DMARC1; p=none; rua=m |
DKIM needs a selector: the mail provider tells you which one it uses, and the record goes at that label plus _domainkey. A Google Workspace domain commonly uses google._domainkey; a host's mail service uses its own label.
The order that avoids broken mail
Set SPF and DKIM first, wait 48 hours, then publish DMARC with p=none and read the reports before tightening. Doing it in the other order is how a domain ends up rejecting its own invoices.
- List every service that sends mail as your domain: the mailbox host, the newsletter tool, the invoice system, the website's contact form.
- Publish one SPF record at the root that includes all of them.
- Turn on DKIM at the mail host and publish the public key it gives you.
- Wait 48 hours so receivers cache the authenticated state.
- Publish DMARC at
_dmarcwithp=noneand aruamailbox for reports. - After two to four weeks of clean reports, change to
p=quarantine, then top=reject.
At p=none nothing is blocked; you are only collecting data. That window is the whole point of the rollout, because it shows which sender you forgot.
Build the SPF record
One TXT record at the root, starting with v=spf1 and ending with an all mechanism. Every sender is an include: or an ip4: inside that single string.
v=spf1 include:_spf.google.com include:zoho.in ip4:203.0.113.10 -all
Use -all when the list is complete and ~all while you are still finding senders; the tilde marks a soft fail instead of a hard one. The record may contain at most ten DNS lookups, and each include: can cost more than one. A record that exceeds the limit returns permerror, which is worse than no record at all.
- Never publish two records beginning
v=spf1; merge them instead. - Never end with
+all; it authorises every server on the internet. - Keep the record under 255 characters per string; some panels split long values automatically.
- Count the lookups with a free SPF checker before you save.
Build the DMARC record
A TXT record at _dmarc with two required tags, v=DMARC1 and p, plus a reports address. Start at p=none even if you are confident, because the first report usually names a sender you forgot.
v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100; adkim=r; aspf=r
| Tag | What it sets | Useful starting value |
|---|---|---|
| p | Action when both checks fail: none, quarantine or reject | none, then quarantine, then reject |
| rua | Mailbox that receives aggregate XML reports | a dedicated address, not your inbox |
| pct | Percentage of failing mail the policy applies to | 100 once reports are clean |
| adkim / aspf | Strict (s) or relaxed (r) alignment for DKIM and SPF | r, unless subdomains are outside your control |
Alignment is the part people miss. A message passes DMARC when SPF or DKIM passes and the authenticated domain matches the From domain. A newsletter sent through a third party can pass SPF for the vendor's domain and still fail DMARC, because the From domain is yours. The fix is the vendor's own DKIM signature, not a looser policy.
DKIM: what to copy and where it goes
The mail host generates a key pair and shows you the selector and the public key. Publish the public key as a TXT record at selector._. The private key stays with the sender and never appears in DNS.
Choose 2048-bit keys where the provider offers the choice. When you rotate the key, publish the new record before the provider starts signing with it, or messages fail DKIM for the length of the DNS TTL. After a migration between hosts, the old selector often stays in DNS and the new one is missing; that is the most common DKIM failure.
Check the setup from outside
Query the records the way a receiving server would, then send a real message. A DNS answer and a passing message together are the only proof that the setup works.
dig +short TXT example.comshould return the single SPF string.dig +short TXT _dmarc.example.comshould return the DMARC record, quoted.dig +short TXT google._domainkey.should return the DKIM key for that selector.example.com - On Windows, use
nslookup -type=txt _dmarc.example.com 8.8.8.8to query a public resolver. - Send a message to a Gmail account, open it, choose Show original, and read the SPF, DKIM and DMARC lines. All three should say PASS.
In cPanel, the same records live under Zone Editor, then Manage next to the domain. Use add a TXT record in cPanel for the click path, and remember that some panels append the domain to the host field automatically.
Common failures and fixes
Most failures come from four causes: a duplicate SPF record, a missing DKIM selector after a migration, a third-party sender missing from SPF, or a DMARC record saved at the wrong host name. Match the symptom, make one change, and re-check.
| Symptom | Likely cause | Fix |
|---|---|---|
| SPF returns permerror | Two v=spf1 records, or more than ten DNS lookups | Merge into one record and remove unused includes |
| DMARC shows none after saving | Record saved at the root instead of _dmarc | Move it to the _dmarc host and re-query |
| DKIM fails after moving hosts | New selector not published | Add the new selector. |
| Mail to Gmail lands in spam after p=reject | A sender is missing from SPF or has no DKIM | Read the aggregate report, add the sender, then keep reject |
| Message shows "via" in Gmail | Relaxed alignment with a third-party sender | Ask the vendor for DKIM on your domain |
Where this runs on WebJi mail
If your mailboxes sit on business email hosting, DNS is managed in the same cPanel account under Zone Editor, and support will read the records with you. If you use Google Workspace, the admin console shows the DKIM selector to publish; the Google Workspace page covers the mailbox side.
Email support is 24/7 at support@webji.
Frequently Asked Questions
Do I need both SPF and DMARC?
DMARC needs SPF or DKIM to pass, and one of the two aligned with your From domain. SPF alone tells receivers which servers are allowed but gives no policy; DMARC adds the instruction and the reports. Publish both, and DKIM as well.
What DMARC policy should I start with?
Start with p=none and a rua address, run it for two to four weeks, and read the reports for legitimate senders you missed. Then move to p=quarantine, and to p=reject once nothing legitimate fails.
How long before DMARC takes effect?
The record is live as soon as DNS answers for it, usually within minutes to a few hours depending on TTL. Receivers act on it immediately, but aggregate reports arrive daily, so give the rollout weeks rather than hours.
Can I have two SPF records?
No. Two TXT records starting v=spf1 make the check return permerror, and receivers treat the domain as having no valid SPF. Merge every sender into one record with include: mechanisms.
What is the DMARC host value?
The record goes at _dmarc followed by your domain, for example _dmarc.example.
How do I check if SPF and DMARC are working?
Query the DNS: dig +short TXT _dmarc.example.com should return the record. Then send a message to a Gmail account and open Show original; SPF, DKIM and DMARC each show PASS or FAIL for that message.