In what order should I set up SPF, DKIM and DMARC?

SPF and DKIM first (they are what DMARC checks), then DMARC at p=none to observe, then tighten to quarantine and reject once your legitimate senders all pass. Never start at p=reject.

Why are my emails still going to spam with SPF, DKIM and DMARC set?

Common causes: DMARC alignment failing (the From domain does not match the SPF/DKIM domain), two SPF records, exceeding the SPF 10-lookup limit, a mistyped DKIM key, poor sender reputation, or spammy content. Aggregate DMARC reports usually reveal which.

Can I have more than one SPF record?

No — a domain must publish exactly one SPF TXT record. Multiple SPF records are invalid and cause SPF to fail. Merge all your includes into a single record.

How to fix SPF, DKIM and DMARC (and stop landing in spam)

SPF, DKIM and DMARC are the three DNS records that tell inbox providers your email is really from you. Get them right and you reach the inbox; get them wrong — or let them drift — and your mail quietly lands in spam or gets rejected. Here is how each works and how to fix them in the right order.

The three records, in plain terms

They work as a stack — each answers a different question about a message:

SPF (Sender Policy Framework): a TXT record listing which servers are allowed to send mail for your domain. It answers "is this sending IP authorised?"
DKIM (DomainKeys Identified Mail): a cryptographic signature added by your mail server, with the public key published in DNS. It answers "was this message altered, and does the signature match?"
DMARC (Domain-based Message Authentication): a policy that ties SPF and DKIM to your visible From address and tells receivers what to do when a message fails — and where to send reports. It answers "what should happen to mail that fails, and who do I tell?"

Fix SPF

Publish exactly one SPF TXT record at your root domain. Include every service that sends on your behalf (your mail host, marketing platform, help desk, invoicing tool) and end with `~all` (softfail) or `-all` (hardfail).

The two most common failures: having two SPF records (invalid — merge them into one), and exceeding the 10-DNS-lookup limit (each `include:` counts). If you are over the limit, remove services you no longer use or flatten includes.

Fix DKIM

Turn on DKIM signing in each sending platform; it will give you a public key to publish as a TXT (or CNAME) record at a selector like `selector._domainkey.yourdomain.com`. Publish the record exactly as given — a single wrong character breaks the signature.

If you send from multiple platforms, each gets its own selector and its own record. Rotate keys periodically and remove selectors for services you have dropped.

Fix DMARC — start safe

Publish a DMARC TXT record at `_dmarc.yourdomain.com`. Start at `p=none` with a reporting address so you can see what is sending as you before you enforce anything:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Read the aggregate reports, make sure all your legitimate mail passes SPF or DKIM alignment, then tighten to `p=quarantine` and finally `p=reject`. Moving straight to reject before your sources are aligned will block your own newsletters and invoices — see the safe DMARC p=reject rollout.

Keep them from drifting

Email records break long after you set them up: a new tool starts sending unaligned, someone edits DNS, or a provider changes its SPF include. You will not get an error — deliverability just degrades.

Check any domain's current setup with the free SPF & DMARC checker, and let VigilDog's email-deliverability monitoring watch the records so you hear about a change before your open rates do.

Frequently asked

In what order should I set up SPF, DKIM and DMARC?: SPF and DKIM first (they are what DMARC checks), then DMARC at p=none to observe, then tighten to quarantine and reject once your legitimate senders all pass. Never start at p=reject.
Why are my emails still going to spam with SPF, DKIM and DMARC set?: Common causes: DMARC alignment failing (the From domain does not match the SPF/DKIM domain), two SPF records, exceeding the SPF 10-lookup limit, a mistyped DKIM key, poor sender reputation, or spammy content. Aggregate DMARC reports usually reveal which.
Can I have more than one SPF record?: No — a domain must publish exactly one SPF TXT record. Multiple SPF records are invalid and cause SPF to fail. Merge all your includes into a single record.