Short answer: SPF, DKIM and DMARC are three DNS records that help show your email comes from your business. SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC tells receiving servers what to do with mail that fails. To deliver to personal Gmail accounts, Gmail asks every sender for SPF or DKIM, and senders of 5,000 or more messages a day for all three.
The three records
SPF is a line of text in your domain’s DNS that lists the servers that send email for you. Receiving servers check it to confirm a message came from an authorized server.
DKIM signs each message. A private key on your mail server adds the signature, and the public key sits in a TXT record in your DNS. The receiving server uses it to read the signature, which helps protect your domain against spoofing.
DMARC tells receiving servers what to do with mail from your domain that fails SPF or DKIM. To pass, the domain that authenticates the message must match the one in its From: header.
From Google Workspace Help, “Set up SPF”, “Set up DKIM” and “Set up DMARC”, read November 2, 2026.
What Gmail asks of senders
Since February 1, 2024, Gmail sets rules for anyone who sends to personal Gmail accounts, stricter from 5,000 messages a day. Mail that doesn’t meet them may not arrive as expected or may go to spam.
| What Gmail asks | From whom |
|---|---|
| SPF or DKIM for your sending domain | Every sender |
| SPF and DKIM, plus DMARC (the policy can be none) | Senders of 5,000 or more messages a day to Gmail |
| For direct email, your From domain aligned with the SPF or DKIM domain | Senders of 5,000 or more messages a day |
| Spam rate in Postmaster Tools below 0.3% | Every sender |
| One-click unsubscribe and a visible unsubscribe link | Marketing and subscribed mail from senders of 5,000 or more a day |
Google also asks for valid forward and reverse DNS records for your sending servers and a TLS connection, and recommends SPF, DKIM and DMARC for every domain.
From Gmail Help, “Email sender guidelines”.
How to set them up
- List every service that sends email as your domain: your mailbox provider, your email platform, your website, your booking or invoicing tool.
- Write one SPF record that includes all of them, ending in ~all, and add it as a TXT record in your domain’s DNS.
- Turn on DKIM in each sending service and add the key it gives you to your DNS. Gmail needs at least 1,024 bits, and Google recommends 2,048 if your domain provider supports them.
- Add a DMARC record with p=none and a report address, ideally a mailbox only for those reports, so you see who sends mail as your domain.
- Read the reports and fix any service of yours that fails SPF or DKIM.
- Move the policy to quarantine and then to reject, using pct to apply it first to a share of the mail that fails.
- Check each record from outside, for example with a DNS lookup tool, after every change.
If you also send text messages, our guide on 10DLC registration covers the carriers’ rules.
From Google Workspace Help, “Set up SPF”, “Set up DKIM” and “Set up DMARC”.
What our own domain shows
On November 2, 2026, we read our own records. Our DMARC record asks receiving servers to reject mail that fails, with strict alignment for SPF and DKIM, and asks for reports.
Two senders sign our mail with DKIM: our mail host and an email sending service. Our SPF record lists our mail host and our web server, and ends in ~all, as Google recommends.
Before you send your next campaign
- Every service that sends as your domain is in one SPF record.
- Each sending service signs with DKIM, and its key is in your DNS.
- You have a DMARC record with a report address.
- Your From address uses the domain that SPF or DKIM authenticates.
- Your marketing emails have a visible unsubscribe link.
- Your spam rate in Postmaster Tools stays below 0.3%.
RememberPut every sender in one SPF record, turn on DKIM in each one, and start DMARC at p=none with reports. Move to quarantine and reject once your own mail passes.
If you want us to set up your records and your email marketing, see our email and SMS marketing service.
Quick answers about SPF, DKIM and DMARC
What is DMARC?
DMARC is a DNS record that tells receiving servers what to do with mail from your domain that fails SPF or DKIM: deliver it, send it to spam or reject it. It can also send you reports on the mail that claims to come from your domain.
Do I need SPF, DKIM and DMARC?
Gmail asks every sender for SPF or DKIM. If you send 5,000 or more messages a day to personal Gmail accounts, it asks for SPF, DKIM and DMARC. Google recommends setting up all three for every domain.
What DMARC policy should I start with?
Google recommends starting with p=none, which only reports, and moving to quarantine or reject once you see how your mail is authenticated. The pct tag lets you apply the policy to a share of the mail that fails while you check.
What does ~all mean in an SPF record?
It tells receiving servers to mark mail as spam when it comes from a server your SPF record doesn’t list. Google recommends ~all in your SPF record.
Does my email platform handle this for me?
Partly. The platform signs mail with DKIM and gives you the records, but they go in your domain’s DNS, which only you or your domain provider can change. Google says to check that your provider authenticates your mail with SPF and DKIM.
Sources
All read on November 2, 2026. Gmail Help: Email sender guidelines. Google Workspace Help: Set up SPF, Set up DKIM and Set up DMARC. Our own case: our domain’s records on November 2, 2026.