Configure SPF DKIM DMARC for Deliverability

Task Library

Publish SPF, DKIM, and DMARC records so the domain's email authenticates, lands in inboxes instead of spam, and can't be trivially spoofed.

Category: Digital Plumbing

Use this when business email lands in spam, the domain has no authentication records, or a new domain mailbox was just created (run set-up-professional-email-on-domain first).

Inputs

  • DNS access for the domain (TXT/CNAME record management)
  • Mail provider admin access (Google Workspace / Microsoft 365) for DKIM keys
  • Inventory of every service that sends as the domain: mail provider, newsletter tool, CRM, form/SMTP plugin

Steps

  1. Publish SPF: one TXT record on the root domain listing every authorized sender (provider include plus any newsletter/CRM includes), ending in ~all. Exactly one SPF record – merge includes into it; two SPF records fail authentication outright.
  2. Enable DKIM: in the mail provider's admin, generate the DKIM key and publish the selector record DNS entry it gives you. Repeat for third-party senders (newsletter/CRM) using their own selectors.
  3. Publish DMARC: TXT record at _dmarc.yourdomain with p=none and a rua= reporting address to start – observe reports first, then tighten to quarantine/reject once legitimate senders all pass.
  4. Wait for DNS propagation, then test: send from the domain mailbox to a Gmail account, open the message, and use "Show original" – SPF, DKIM, and DMARC must each show PASS.
  5. Test every other sender the same way (newsletter blast, CRM email, website form notification). Anything failing gets added to SPF/DKIM properly – not worked around.
  6. After 2-4 weeks of clean DMARC reports, raise the policy from none toward quarantine/reject and document the final records in the client record.

Definition of done (QA checklist)

  • Exactly one SPF record, covering all real senders
  • DKIM signing enabled and selector records published for the mail provider and third-party senders
  • DMARC record live at _dmarc with reporting configured
  • Gmail "Show original" shows SPF=PASS, DKIM=PASS, DMARC=PASS for the mailbox and each sending service
  • Records and policy plan documented in the client record
  • Linked back to the definitive article and relevant siblings
  • Complies with Blog Posting Guidelines (if it publishes content)

Example(s)

  • Example needed – run the Meta-Article Prompt after first real run.

File in the zip: skills/digital-plumbing/configure-spf-dkim-dmarc-for-deliverability.md. Download the Task Library zip.

Index: Task Library. Article guidelines.

Scroll to Top