SPF, DKIM and DMARC: set them up in Enhance

If emails from your domain keep landing in spam, or a mailbox provider has started bouncing them, the cause is very often three DNS records: SPF, DKIM and DMARC. They tell the receiving server that your email really came from you.

They used to be “nice to have”. Not any more. Since February 2024, Google and Yahoo have required every sender to use SPF or DKIM, and bulk senders (roughly 5,000 or more messages a day) to use all three. In May 2025 Microsoft followed for high-volume mail to Outlook.com, Hotmail and Live addresses.

Even if you only send a handful of emails a day, setting up all three is the simplest way to stay out of spam folders. This guide explains what each record does, shows what they look like, and walks through setting them up in the Enhance control panel.

What is SPF?

SPF (Sender Policy Framework, RFC 7208) is a list of the servers allowed to send email for your domain. It’s published as a single TXT record on the domain itself.

When a message arrives claiming to be from your domain, the receiving server checks whether the sending server is on that list.

A typical SPF record for example.co.uk looks like this:

example.co.uk.  TXT  "v=spf1 a mx include:_spf.google.com ~all"

Reading it left to right:

v=spf1 says this is an SPF record.
a and mx allow the servers your domain’s A and MX records point to.
include:_spf.google.com allows another provider’s servers (Google Workspace, in this example).
~all says anything else is “probably not authorised” (a soft fail). -all is the stricter version: “definitely not authorised”.

SPF has one weakness: it checks the hidden “envelope” sender address, not the From address people see. That’s one of the gaps DMARC closes.

What is DKIM?

DKIM (DomainKeys Identified Mail, RFC 6376) adds a digital signature to every email you send. Your mail server signs each message with a private key, and you publish the matching public key in DNS.

The receiving server fetches that public key and checks the signature. If it matches, the receiver knows two things: the message came from a server holding your key, and nobody changed it on the way.

DKIM records live on a “selector” name under _domainkey. The selector lets you have several keys at once, for example one for your mailbox and one for a newsletter tool:

selector._domainkey.example.co.uk.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"

The p= value is the public key, and it’s long. You never write it yourself: your mail system generates the key pair and shows you the record to publish. Google requires keys of at least 1024 bits and recommends 2048.

Unlike SPF, DKIM usually survives forwarding, because the signature travels with the message.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the From address people actually see. It was defined in RFC 7489, which was replaced in 2026 by RFC 9989. Existing records keep working, and they still start v=DMARC1.

A message passes DMARC when SPF or DKIM passes and the domain it checked matches (or “aligns with”) the From domain. DMARC also tells receivers what to do with mail that fails, and where to send reports.

It’s a TXT record on _dmarc:

_dmarc.example.co.uk.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.co.uk"

p=none means “deliver as normal, just report”. p=quarantine means “send to spam” and p=reject means “refuse it”.
rua= is the address that receives daily summary reports from the big mailbox providers.

SPF, DKIM and DMARC together

Think of it as three questions the receiving server asks:

SPF: is this server allowed to send for this domain?
DKIM: is the signature valid, and is the message unchanged?
DMARC: does at least one of those pass for the domain in the From address, and if not, what does the owner want me to do?

For bulk senders, Google, Yahoo and Microsoft all require SPF and DKIM to pass and a DMARC record of at least p=none. Yahoo notes that relaxed alignment is fine. Bulk senders also need one-click unsubscribe and a spam complaint rate below 0.3%, but those are about your sending habits rather than DNS.

How to enable DKIM in the Enhance control panel

Every SharedGrid hosting plan runs on Enhance, and it does a lot of this for you. According to Enhance’s email authentication documentation:

SPF is added automatically to every new DNS zone, as v=spf1 a mx ~all. That covers the servers your website and email run on.
DMARC is added automatically to every zone with p=none, so you start in monitoring mode.
DKIM is switched on per domain. If your DNS is hosted on Enhance, the record is handled for you. If it’s elsewhere, Enhance shows you what to add.

To switch DKIM on, the docs describe these steps:

Open Websites in the left sidebar and choose your website.
Select Domains from the top menu, then the domain you send email from.
Scroll to the email authentication section and turn DKIM on.
If your DNS is hosted on Enhance, wait for it to validate. If your DNS is somewhere else, follow the instructions on screen.

Your panel may look slightly different depending on your plan. If you can’t find the setting, ask us and we’ll switch it on for you.

You can also edit the SPF and DMARC records for each domain in its DNS settings, for example to add a newsletter tool or tighten your DMARC policy.

When your DNS is at another provider, such as Cloudflare

If your domain’s nameservers point to your registrar or a service like Cloudflare, rather than to your hosting, Enhance can’t add records for you. You’ll need to copy them across by hand:

DKIM: turn DKIM on in Enhance as above, then copy the record name and value it shows into a new TXT record at your DNS provider. Copy the whole key: a single missing character breaks it. Some providers add your domain to the end of the name automatically, so you may only need the selector._domainkey part.
SPF: make sure your SPF record includes the servers your Enhance email sends from. Copy what your panel shows, or ask our support team for the exact values. Don’t add a second SPF record (more on that below).
DMARC: add a _dmarc TXT record yourself if one doesn’t exist.

Two Cloudflare tips. The A record for your mail server must be “DNS only” (grey cloud), because Cloudflare’s proxy doesn’t carry email. And if your website’s A record is proxied, the a in your SPF record points at Cloudflare rather than your server, so don’t rely on it to cover your email.

How to check your SPF, DKIM and DMARC records

Once the records are in place, give DNS a little time to update, then check them.

From a terminal on macOS or Linux, use dig:

dig +short TXT example.co.uk
dig +short TXT selector._domainkey.example.co.uk
dig +short TXT _dmarc.example.co.uk

On Windows, nslookup does the same job:

nslookup -type=TXT _dmarc.example.co.uk

If you’d rather not use the command line, free online checkers such as Google Admin Toolbox and MXToolbox will look up your records and flag common errors.

The best test is a real email. Send one to a Gmail address, open it, and choose Show original. You’ll see a line each for SPF, DKIM and DMARC, marked PASS or FAIL.

A safe DMARC rollout: none, quarantine, then reject

Jumping straight to p=reject is the fastest way to block your own invoices, contact forms or newsletters. Roll it out in stages instead:

Start with p=none and a rua= address. Leave it for a few weeks and read the reports. They show every service sending as your domain, including ones you’d forgotten about.
Fix anything failing. Add missing senders to SPF, and turn on DKIM in each tool that sends for you.
Move to p=quarantine. Mail that fails now goes to spam rather than the inbox. Watch the reports for another few weeks.
Move to p=reject once you’re confident everything legitimate passes.

Raw DMARC reports are XML files, which aren’t much fun to read. Several services will turn them into readable summaries, and many have free plans for small domains.

Common SPF and DKIM mistakes

Two SPF records. A domain can only have one. If there are two, receivers treat SPF as a permanent error and it fails. This often happens when someone adds a new provider’s record instead of merging it. Combine them into one:

v=spf1 a mx include:_spf.google.com include:spf.newsletter.example ~all

Going over the 10-lookup limit. SPF allows at most 10 DNS lookups. Each include, a, mx, exists and redirect counts, and so do the lookups inside every include. Go over and SPF fails. Remove providers you no longer use, and use ip4: or ip6: for fixed addresses, which don’t count towards the limit.

Forgetting third-party senders. Newsletter tools, booking systems, shops and CRMs often send as your domain. Each one needs to be in your SPF record, or better still, set up with its own DKIM key. Their help pages will give you the records.

Broken or shortened DKIM keys. Long keys sometimes get cut off when pasted. Some DNS providers need very long TXT values split into chunks, and most do it for you. If DKIM fails, compare the published record with the one your panel shows.

Leaving DMARC at p=none forever. It’s the right place to start, but it doesn’t stop anyone pretending to be you. Plan the move to quarantine and reject.

Questions

Do I need DKIM if I only send a few emails?

The strictest rules apply to bulk senders, but Google and Yahoo expect everyone to use at least SPF or DKIM. With all three in place, your mail is far less likely to be marked as spam. It costs nothing, and in Enhance it’s one switch.

Can I have more than one DKIM record?

Yes. Each sender uses its own selector, so your mailbox, your newsletter tool and your shop can each have their own key. You can only have one SPF record and one DMARC record, though.

How long do DNS changes take?

Usually minutes, but it can take a few hours, depending on the record’s TTL and your DNS provider. If a checker still shows the old value, wait and try again.

Will DMARC stop my emails being delivered?

Not at p=none, which only reports. Only quarantine and reject affect delivery, which is why you should read the reports first.

Does this matter for WordPress contact forms?

Yes. If your site sends mail as your domain, it needs to pass the same checks. A reliable fix is an SMTP plugin that sends through a real mailbox on your domain, so form emails go out from the same server as the rest of your mail.

Get it set up with SharedGrid

Our web hosting includes email on your own domain, and when your DNS is with us, SPF and DMARC are added automatically and DKIM is one switch away. If your DNS is somewhere else, or you’d just like someone to check it, contact our support team and we’ll help you set the records up.

Checked against Google, Yahoo and Enhance documentation, November 2026.

SPF, DKIM and DMARC explained, and how to set them up in Enhance