Before you start
- Access to your domain's DNS records
- A list of everything that sends mail as your domain
Step 1: List every sender first
Your mail server, your website's contact form, your invoicing tool, your newsletter platform, your CRM. Each one sends as your domain, and any you forget will start failing the moment you publish a strict policy. This list is the whole job — the DNS records are the easy part.
Step 2: Publish one SPF record
SPF names the servers allowed to send as your domain. You may only have ONE SPF record per domain; two is a permanent error and worse than none. Merge every sender into a single record.
v=spf1 include:_spf.yourhost.com include:_spf.google.com ~allStep 3: Turn on DKIM at each sender
DKIM signs outgoing mail cryptographically so a receiver can tell it was not altered. Each platform gives you a public key to publish as a TXT record at its own selector. Do this for every sender on your list, not just the main mailbox.
Step 4: Start DMARC in monitor mode
DMARC tells receivers what to do when SPF and DKIM fail. Start with p=none, which changes nothing and only asks for reports. Do not skip this step — going straight to reject is how legitimate mail disappears.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comStep 5: Read the reports for two weeks
The aggregate reports show every source sending as your domain, including ones you forgot. Fix each legitimate sender until it passes. Anything still failing after that is either misconfigured or is not yours.
Step 6: Tighten the policy
Once the reports are clean, move to p=quarantine, watch for another fortnight, then p=reject. That final record is what stops other people sending mail that looks like it came from you.
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
The mistake people make
Two SPF records on one domain. It is a permanent failure, not a warning, and it makes deliverability worse than having no SPF at all. If you are adding a sender, edit the existing record — never add a second.