Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Adding DNS records: SPF, DKIM and DMARC

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

What SPF, DKIM and DMARC records are, where to add them, typical values for common mail services, and how long they take to work.

Receiving mail servers decide whether to trust your email partly by checking three DNS records on your domain: SPF, DKIM and DMARC. This article explains each record in plain terms and shows where to add them. It is for anyone sending from their own domain through CRM-NG SMTP.

If you send from a free address such as @gmail.com, you cannot add these records. The provider controls them. That is one reason to send from your own domain.

The three records in one minute

  • SPF (Sender Policy Framework) is a list of the services allowed to send email for your domain. It is one TXT record on the domain itself.
  • DKIM (DomainKeys Identified Mail) is a digital signature your mail service adds to each message. You publish the matching public key in DNS so receivers can check the signature. It usually lives at selector._domainkey.yourdomain.com.
  • DMARC tells receivers what to do when SPF and DKIM do not line up with the From address (nothing, send to spam, or reject), and where to send reports. It lives at _dmarc.yourdomain.com.

You need all three for reliable delivery to Gmail, Yahoo and Outlook.com, which now expect authenticated mail from anyone sending in volume.

Where to add DNS records

DNS records are managed wherever your domain's nameservers point. That is usually one of:

  • Your domain registrar (where you bought the domain).
  • Your web host's control panel (cPanel, Plesk and similar have a Zone Editor or DNS page).
  • A DNS service such as Cloudflare.

If you are not sure, look up your domain's nameservers with any online "NS lookup" tool. The company named there is where you edit DNS.

Each record has a type (TXT or CNAME), a name or host (@ for the domain itself, or a sub-name like _dmarc), and a value.

Step 1: SPF

Your mail service tells you what to add, normally an include: entry. A typical record looks like this:

Type: TXT   Name: @   Value: v=spf1 include:_spf.google.com ~all

Rules that trip people up:

  • One SPF record per domain. If you already have one (for your office email, say), add the new include: to it. Do not create a second v=spf1 record; two records make both invalid.
  • Ten-lookup limit. Each include: costs at least one DNS lookup, and SPF allows ten. Remove services you no longer use.
  • ~all or -all. ~all (soft fail) is the safe starting point. Move to -all once you are sure every sender is listed.

Typical includes. Always confirm the exact value in your provider's dashboard, because some providers give each account its own value.

Mail service Typical SPF include
Google Workspace / Gmail _spf.google.com
Microsoft 365 spf.protection.outlook.com
Zoho Mail zoho.com (or the domain for your Zoho region, such as zoho.eu)
SendLayer sendlayer.net
SMTP.com smtp.com
Brevo sendinblue.com (Brevo may ask for a verification code record instead)
SendGrid sendgrid.net
Mailgun mailgun.org
Postmark spf.mtasv.net
SparkPost sparkpostmail.com
Mailjet spf.mailjet.com
Mandrill spf.mandrillapp.com
Resend, Amazon SES amazonses.com, usually on a custom MAIL FROM sub-domain the service names

The plugin's domain check, which runs after each test email, looks for the include it expects for your chosen mailer.

Step 2: DKIM

DKIM values are unique to your account, so they always come from your mail service's dashboard. Look for a page called "domain authentication", "sender authentication", "DKIM" or "verify domain". You will be given one of:

  • A TXT record with a long public key, for example at google._domainkey for Google Workspace (you generate it in the Google Admin console and then press Start authentication there).
  • One or more CNAME records that point to the provider, as used by Microsoft 365 (selector1 and selector2), Amazon SES (three records) and many API services.

Copy each name and value exactly. Some DNS panels add your domain to the name automatically, so google._domainkey may need to be entered without .yourdomain.com on the end. Then return to the provider's dashboard and press its verify button.

Step 3: DMARC

Add DMARC after SPF and DKIM pass, so you do not tell receivers to reject your own mail. Start in monitoring mode:

Type: TXT   Name: _dmarc   Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
  • p=none only collects reports. After a few weeks of clean reports, move to p=quarantine and later p=reject.
  • rua= is where daily summary reports go. Use a mailbox you check, or a DMARC reporting service.

How long it takes

New records usually work within minutes to an hour, but can take up to 48 hours to reach every DNS server. The delay depends on the record's TTL (time to live). If a check fails straight after you add a record, wait and try again before changing anything.

Check your work

Send a test from CRM-NG SMTP → Tools → Email Test and read the domain check, then confirm the real result in the message headers. See Verifying your DNS records.

Go to Top