How do you set up SPF, DKIM and DMARC?
Three DNS records, three separate jobs. The order matters: SPF and DKIM first, DMARC after.
updated · 2026-09-17
How do you add an SPF record?
An SPF record is a TXT record added to your domain's DNS that lists who may send email in your name. DKIM signs the outgoing email with your domain's key. DMARC says what should happen when those two checks fail. Without all three in place, the chance of your email landing in the spam folder rises noticeably.
How do you add an SPF record?
SPF is a single TXT record on your domain's root. It lists the servers that send email in your name, starts with v=spf1 and ends with a policy term.
A domain has exactly one SPF record. Adding a second one breaks verification completely; when you add a new sending tool, you add it inside the existing record.
- Open your domain's DNS panel.
- Check whether a v=spf1 record already exists; if it does, do not add another.
- Add the sending server inside the existing record.
- Publish the record and wait for it to propagate.
- Send a test email and look for spf=pass in the headers.
How do you turn on DKIM signing?
With DKIM your email provider generates a key pair. You add the public key to DNS as a TXT record; the private key stays with the provider and signs every outgoing email.
The record name contains a selector. If one domain has several sending tools, each can run alongside the others with its own selector — that is what makes it different from SPF.
Pocufy
Three agents run the part of these steps that repeats every week: defining the audience, building the list, writing each email for the person, and following up on the reply.
How do you choose a DMARC policy?
Start the DMARC record at p=none. That mode blocks nothing; it only reports who is sending in your name.
After watching the reports for a few weeks and confirming that all legitimate sending passes, move the policy to p=quarantine and then p=reject. Skip a step and your own invoices or newsletter can be rejected.
How do you check it once it is set up?
Send yourself a test email and open the raw headers. You need to see all three of spf=pass, dkim=pass and dmarc=pass.
If all three pass and the email still lands in spam, the problem is not the records but the reputation: review the daily volume, the email text and the quality of the list.
Common questions
Within minutes on most providers, and within a few hours at most depending on the record's TTL. Waiting a short while before checking saves you from seeing a false failure.
If the email goes out from a subdomain, yes. SPF and DKIM look at the domain the email leaves from; DMARC covers subdomains by default but you can define a separate policy if you want to.
Pocufy
Rather than doing all of this by hand, try it: paste your website link and get your first customer list in ten minutes.
this page answers these searches
- how to add an spf record
- what is an spf record
- what is a dkim record
- dkim and dmarc explained
other guides
- I can't find customers — what should I do?The problem is usually not reaching too few people. It is writing the same thing to the wrong ones. This guide sets out the order.
- How do you write a cold email?The job of the first email is not to sell but to get a reply. This guide covers the structure that produces one.
- How do you set up cold email automation?The hard part of automation is not sending. It is arriving. This guide sets out the setup in the right order.