# Adding DNS records: SPF, DKIM and DMARC Source: https://catalystgroup.gg/docs/email-delivery/dns-records/ Updated: 2026-10-19 · By Duane Garner What SPF, DKIM and DMARC records are, where to add them, typical values for common mail services, and how long they take to work. Receiving mail servers decide whether to trust your email partly by checking three DNS records on your domain: SPF, DKIM and DMARC. This article explains each record in plain terms and shows where to add them. It is for anyone sending from their own domain through CRM-NG SMTP. If you send from a free address such as `@gmail.com`, you cannot add these records. The provider controls them. That is one reason to send from your own domain. ## The three records in one minute - **SPF** (Sender Policy Framework) is a list of the services allowed to send email for your domain. It is one TXT record on the domain itself. - **DKIM** (DomainKeys Identified Mail) is a digital signature your mail service adds to each message. You publish the matching public key in DNS so receivers can check the signature. It usually lives at `selector._domainkey.yourdomain.com`. - **DMARC** tells receivers what to do when SPF and DKIM do not line up with the From address (nothing, send to spam, or reject), and where to send reports. It lives at `_dmarc.yourdomain.com`. You need all three for reliable delivery to Gmail, Yahoo and Outlook.com, which now expect authenticated mail from anyone sending in volume. ## Where to add DNS records DNS records are managed wherever your domain's **nameservers** point. That is usually one of: - Your domain registrar (where you bought the domain). - Your web host's control panel (cPanel, Plesk and similar have a **Zone Editor** or **DNS** page). - A DNS service such as Cloudflare. If you are not sure, look up your domain's nameservers with any online "NS lookup" tool. The company named there is where you edit DNS. Each record has a **type** (TXT or CNAME), a **name** or **host** (`@` for the domain itself, or a sub-name like `_dmarc`), and a **value**. ## Step 1: SPF Your mail service tells you what to add, normally an `include:` entry. A typical record looks like this: ``` Type: TXT Name: @ Value: v=spf1 include:_spf.google.com ~all ``` Rules that trip people up: - **One SPF record per domain.** If you already have one (for your office email, say), add the new `include:` to it. Do not create a second `v=spf1` record; two records make both invalid. - **Ten-lookup limit.** Each `include:` costs at least one DNS lookup, and SPF allows ten. Remove services you no longer use. - **`~all` or `-all`.** `~all` (soft fail) is the safe starting point. Move to `-all` once you are sure every sender is listed. Typical includes. Always confirm the exact value in your provider's dashboard, because some providers give each account its own value. | Mail service | Typical SPF include | | --- | --- | | Google Workspace / Gmail | _spf.google.com | | Microsoft 365 | spf.protection.outlook.com | | Zoho Mail | zoho.com (or the domain for your Zoho region, such as zoho.eu) | | SendLayer | sendlayer.net | | SMTP.com | smtp.com | | Brevo | sendinblue.com (Brevo may ask for a verification code record instead) | | SendGrid | sendgrid.net | | Mailgun | mailgun.org | | Postmark | spf.mtasv.net | | SparkPost | sparkpostmail.com | | Mailjet | spf.mailjet.com | | Mandrill | spf.mandrillapp.com | | Resend, Amazon SES | amazonses.com, usually on a custom MAIL FROM sub-domain the service names | The plugin's domain check, which runs after each test email, looks for the include it expects for your chosen mailer. ## Step 2: DKIM DKIM values are unique to your account, so they always come from your mail service's dashboard. Look for a page called "domain authentication", "sender authentication", "DKIM" or "verify domain". You will be given one of: - A **TXT** record with a long public key, for example at `google._domainkey` for Google Workspace (you generate it in the Google Admin console and then press **Start authentication** there). - One or more **CNAME** records that point to the provider, as used by Microsoft 365 (`selector1` and `selector2`), Amazon SES (three records) and many API services. Copy each name and value exactly. Some DNS panels add your domain to the name automatically, so `google._domainkey` may need to be entered without `.yourdomain.com` on the end. Then return to the provider's dashboard and press its verify button. ## Step 3: DMARC Add DMARC **after** SPF and DKIM pass, so you do not tell receivers to reject your own mail. Start in monitoring mode: ``` Type: TXT Name: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com ``` - `p=none` only collects reports. After a few weeks of clean reports, move to `p=quarantine` and later `p=reject`. - `rua=` is where daily summary reports go. Use a mailbox you check, or a DMARC reporting service. ## How long it takes New records usually work within minutes to an hour, but can take up to 48 hours to reach every DNS server. The delay depends on the record's TTL (time to live). If a check fails straight after you add a record, wait and try again before changing anything. ## Check your work Send a test from **CRM-NG SMTP → Tools → Email Test** and read the domain check, then confirm the real result in the message headers. See [Verifying your DNS records](https://catalystgroup.gg/docs/email-delivery/verify-dns-records/). ## Related - [Verifying your DNS records](https://catalystgroup.gg/docs/email-delivery/verify-dns-records/) - [Emails landing in spam](https://catalystgroup.gg/docs/email-delivery/emails-landing-in-spam/) - [Sending a test email](https://catalystgroup.gg/docs/email-delivery/send-a-test-email/) - [Choosing a mail service](https://catalystgroup.gg/docs/email-delivery/choose-a-mailer/)