SPF, DKIM and DMARC Setup: Small Business Email Guide

November 12, 2026 · Lizzard Solutions

SPF DKIM DMARCEmail SecurityEmail DeliverabilityCybersecuritySmall Business IT

By Nemanja Vukmirović, Lizzard Solutions. Last updated 12 November 2026.

Your invoice lands in the client’s spam folder. A week later, someone sends a fake invoice from an address that looks exactly like yours, with new bank details. Both problems have the same root cause: your domain never told the world which servers may send email in its name.

An SPF DKIM DMARC setup fixes that. These are three DNS records that prove your email is really from you, help it reach the inbox, and tell receiving servers what to do with forgeries. This guide walks a small business through all three, with copy-ready examples, in about an afternoon of work.

---

What are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are email authentication standards published as DNS records on your domain. SPF lists the servers allowed to send your mail. DKIM adds a cryptographic signature that proves the message wasn’t altered. DMARC checks that one of them matches the visible From address and tells receivers whether to deliver, quarantine or reject mail that fails.

Action today: look up your domain in the free Google Admin Toolbox Check MX and note which of the three records already exist.

---

Why small businesses can’t skip email authentication

Two things changed. First, mailbox providers got strict. Google’s email sender guidelines require every sender to Gmail accounts to set up SPF or DKIM, and bulk senders (more than 5,000 messages a day) to use SPF, DKIM and DMARC with an aligned From domain. Mail that fails may be rate-limited, marked as spam or rejected.

Second, spoofing is cheap. Without DMARC, anyone can put your domain in the From line. Fake invoices and “please update our bank details” emails are a classic payment fraud, and your clients can’t tell the difference. Email authentication is one layer of the wider cybersecurity for small business basics, next to multi-factor authentication on every mailbox.

---

Before you start: list every service that sends as your domain

Most broken setups fail here. Email doesn’t only come from your mailbox provider. Write down every system that sends mail with your domain in the From address:

If your website form sends from the web server, it will fail DMARC later. Our guide to contact form spam protection explains how to route form mail through a proper SMTP service. Not sure where your DNS is managed? It is usually at your registrar, as described in our .rs domain registration guide.

Action today: search your inbox for mail sent “from” your domain by tools, not people. Each one is a line in this list.

---

SPF DKIM DMARC setup: 5 steps

Step 1: Publish one SPF record

SPF is a single TXT record on your domain. For Google Workspace, Google’s SPF setup guide uses this value:

example.com  TXT  "v=spf1 include:_spf.google.com ~all"

For Microsoft 365, Microsoft documents include:spf.protection.outlook.com in its SPF configuration guide. Add each extra sender’s include from your list, for example a newsletter tool:

example.com  TXT  "v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ~all"

• Keep one SPF record per domain. Two separate v=spf1 records make SPF fail with an error under RFC 7208.
• SPF allows at most 10 DNS lookups. Every include counts, including the includes inside it. Remove tools you no longer use.
• ~all (softfail) is a safe start. Switch to -all once DMARC reports show every sender is covered.

Step 2: Turn on DKIM signing

DKIM keys are generated by the service that sends the mail, not by you. In Google Workspace or Microsoft 365, open the admin console’s email authentication section, generate a key (choose 2048-bit where offered), publish the TXT or CNAME record it shows, wait for DNS, then press Start authentication or enable signing. Repeat for each tool on your list that supports a custom sending domain.

Step 3: Publish DMARC in monitoring mode

Create a TXT record at _dmarc with policy none and a reporting address. Use a dedicated mailbox, because reports arrive daily as XML attachments.

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Step 4: Read the reports for 2 to 4 weeks

Aggregate reports show which IP addresses sent mail as your domain and whether SPF and DKIM passed and aligned. Upload them to a free DMARC report viewer to make them readable. Every legitimate sender that fails goes back to step 1 or 2. Unknown senders you don’t recognise are often spoofing attempts, which is exactly what DMARC is about to block.

Step 5: Move to quarantine, then reject

When reports show only your real senders passing, tighten the policy. Many teams step through quarantine first:

_dmarc.example.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Action today: finish steps 1 to 3. Put a calendar reminder three weeks out for step 4.

---

DMARC policies compared

DMARC also has a pct tag in RFC 7489 for applying a policy to only part of the failing mail. It can help large senders roll out gradually. A small business with a clean report usually doesn’t need it.

---

Common mistakes that break email delivery

• Two SPF records after adding a new tool. Merge them into one.
• Too many includes, passing the 10-lookup limit. Drop old tools first.
• Jumping straight to reject and silently blocking your own invoices or webshop emails.
• Forgetting the website server, so order confirmations vanish once DMARC is enforced.
• Leaving unused domains open. A domain that never sends email should say so: v=spf1 -all plus a DMARC reject record, as shown below.

old-brand.com  TXT  "v=spf1 -all"
_dmarc.old-brand.com  TXT  "v=DMARC1; p=reject;"

---

How to check that it works

Send a message from each sender on your list to a Gmail address. Open it, choose Show original, and look for SPF, DKIM and DMARC showing PASS. Check the domain again in Google Admin Toolbox. Our free website security check also flags missing or weak email records alongside your site’s HTTPS and headers.

Action today: send one test from your mailbox, one from your website form and one from your newsletter tool, and check all three.

---

FAQ

Do I need SPF, DKIM and DMARC if I send only a few emails a day?

Yes. Gmail requires SPF or DKIM from every sender regardless of volume, and DMARC is what stops others from sending fake mail as your domain. For a small business the work is a few DNS records and an afternoon of testing, and it protects every invoice and offer you send.

Will DMARC stop my emails going to spam?

It helps, but it isn’t a guarantee. Authentication proves the mail is really yours. Inbox placement also depends on spam complaints, content, list quality and sender reputation. Gmail, for example, asks senders to keep spam rates in Postmaster Tools below 0.3%, on top of authentication.

How long does it take to reach p=reject?

For a typical small business with three to five sending tools, plan two to six weeks. Records go live within hours, but you need a few weeks of DMARC reports to be sure every legitimate sender passes before you ask receivers to refuse failing mail.

Can I set this up without an IT person?

If you can edit DNS at your registrar and use your mailbox admin console, yes. The risky parts are merging SPF includes and moving to reject. If a mistake would block invoices or webshop orders, get a second pair of eyes before enforcing the policy.