SPF, DKIM and DMARC Setup for Email Marketing (2026): Record Generator
Disclosure: SoftwareStackPro may earn a commission if you sign up through some links on this page, at no extra cost to you. It never changes our verdicts. Read our affiliate disclosure.
To keep marketing emails out of spam, your domain needs three DNS records: SPF lists who may send for you, DKIM signs each email, and DMARC tells inboxes what to do when a check fails. Gmail requires all three once you send 5,000 or more emails a day.
Use the generator below to build your SPF and DMARC records in two minutes. Start DMARC at p=none, then tighten it once your reports look clean.
You wrote a great email, hit send and watched your open rate fall off a cliff. Often the email was fine, but inboxes could not prove it really came from you.
This guide fixes that in plain English. Build your records with the generator, follow the steps and work through the checklist, which saves your progress.
SPF and DMARC generator
SPF and DMARC record generator
Tick the services that send email for your domain, then copy the records into your DNS. Nothing you type leaves this page.
1. Your SPF record
Add as a TXT record. Host or name: @ (your root domain).
2. Your DMARC record
Add as a TXT record. Host or name: _dmarc
3. Your setup checklist
Your ticks are saved in this browser, so you can come back and finish later.
Why your emails land in spam
Anyone can type your address into the From line of an email. Inboxes like Gmail and Outlook stop that kind of spoofing by checking whether your domain approved the sender.
If those checks are missing or fail, your email looks like it could be fake. It may be filtered to spam or rejected, even when your content is perfect.
| Record | What it does | Simple analogy |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | A guest list at the door |
| DKIM | Adds a digital signature that proves the email was not changed | A wax seal on a letter |
| DMARC | Tells inboxes what to do when SPF or DKIM fails, and sends you reports | The rule book for the bouncer |
SPF explained
SPF is one TXT record on your root domain. It starts with v=spf1, lists each service with an include: value and ends with ~all or -all.
Google Workspace uses include:_spf.google.com and Microsoft 365 uses include:spf.protection.outlook.com. Your email marketing platform shows its own value, if it needs one, in its domain settings.
Watch the 10 lookup limit: SPF can trigger at most 10 DNS lookups. Too many includes break the whole record, so remove services you have stopped using.
DKIM explained
DKIM signs every email with a private key, and your DNS holds the matching public key. If anyone changes the email on the way, the signature no longer matches.
You do not write DKIM records yourself. Your mailbox provider and your email marketing tool each generate them, and you copy them into your DNS exactly as shown.
Turn on DKIM in both places. Your everyday mailbox and your newsletter tool send from different servers, so each needs its own signature.
DMARC explained
DMARC is a TXT record on the host _dmarc. It checks that the domain in your From line matches the domain that passed SPF or DKIM, which is called alignment.
It also sets your policy. none only monitors, quarantine sends failures to spam and reject blocks them.
The reports are the hidden gift. They show every service sending email as your domain, so you can spot a forgotten tool or someone spoofing you.
Gmail and Yahoo bulk sender rules
Google’s email sender guidelines set the bar most marketers now work to. All senders need SPF or DKIM, and bulk senders of 5,000 or more messages a day to Gmail need SPF, DKIM and DMARC.
| Requirement | All senders | 5,000+ a day |
|---|---|---|
| SPF or DKIM | Required | Both required |
| DMARC | Recommended | Required, policy can be none |
| From domain aligned with SPF or DKIM | Recommended | Required |
| One click unsubscribe | Recommended | Required for marketing mail |
| Spam rate in Postmaster Tools | Below 0.10%, never 0.30% | Below 0.10%, never 0.30% |
| Valid PTR records and TLS | Required | Required |
Source: Google email sender guidelines, checked 5 November 2026. Your email platform handles PTR records and TLS for the mail it sends.
Even if you send far fewer than 5,000 emails a day, follow the bulk rules anyway. They cost nothing and protect your domain as your list grows.
Step by step setup
Step 1, list your senders: write down every tool that sends email from your domain. Think mailbox, newsletter tool, online shop, booking system and invoicing.
Step 2, publish SPF: build the record with the generator above and add it as one TXT record at @. If an SPF record already exists, merge the includes into it.
Step 3, turn on DKIM: enable it in your mailbox provider, then in your email marketing tool. Copy each DKIM record into your DNS and press verify.
Step 4, publish DMARC at p=none: add the record at _dmarc with a reporting address. Read the reports for two to four weeks.
Step 5, tighten the policy: once every real sender passes, move to quarantine, then to reject. Raise the percentage gradually if you want a gentler rollout.
Step 6, watch your reputation: set up Google Postmaster Tools and keep your spam rate under 0.10%. Remove inactive subscribers before they start marking you as spam.
7 mistakes that break authentication
Two SPF records: inboxes treat this as an error, so neither works. Merge them into one.
Too many includes: going over 10 DNS lookups breaks SPF. Remove old services and avoid nesting extra includes.
Forgetting the newsletter tool: your mailbox passes but your campaigns fail. Authenticate the domain inside your email marketing platform too.
Jumping straight to reject: you can block your own invoices or booking emails. Start at none and read the reports first.
Sending from a free address: a Gmail or Yahoo From address cannot pass DMARC through a marketing tool. Always send from your own domain.
Typos in the host field: DMARC must sit at _dmarc, not on the root. Some DNS panels add your domain automatically, so do not type it twice.
Ignoring list hygiene: perfect records cannot save a list full of people who never open. Clean inactive contacts every few months.
Which email tools make this easiest?
Every major email marketing platform walks you through domain authentication, but some make it smoother than others. Our MailerLite review, Kit review and Mailchimp review cover setup in detail.
Still choosing a platform? Take the 2 minute email tool quiz or price your list with the email marketing cost calculator.
Frequently asked questions
Do I need SPF, DKIM and DMARC for email marketing?
Yes, if you send in bulk. Google requires all three for senders of 5,000 or more messages a day to Gmail, and all senders need at least SPF or DKIM.
What is the minimum DMARC policy for Gmail?
Google says your DMARC enforcement policy can be set to none. Start with p=none, read the reports for a few weeks, then move to quarantine and reject.
Can I have two SPF records?
No. A domain must have only one SPF record, so merge every sending service into a single record instead of adding a second one.
Where do I find my email platform’s DKIM record?
Look in your email marketing tool’s domain authentication or sender settings. It shows the exact DKIM records, usually CNAME or TXT entries, to copy into your DNS.
How long do DNS changes take to work?
Many changes show up within an hour, but DNS can take up to 48 hours to update everywhere. Check again with your email tool’s verify button after waiting.
What spam rate does Gmail allow?
Google asks senders to keep the spam rate in Postmaster Tools below 0.10% and never reach 0.30% or higher.
