---
title: Set up SPF, DKIM and DMARC for your domain
description: Three DNS records that prove your email really comes from you, so it lands in the inbox instead of spam.
url: "https://staging-learn.web7tech.com/docs/set-up-spf-dkim-and-dmarc-for-your-domain/"
updated: "2026-10-19"
category: "Cloudflare & DNS"
tags:
  - DNS
  - Email
---

# Set up SPF, DKIM and DMARC for your domain

If your messages land in spam, or never arrive at all, the cause is usually missing email authentication. Three DNS records (SPF, DKIM and DMARC) prove to Gmail, Outlook and everyone else that mail from your domain really comes from you. Gmail and Yahoo now require them from anyone who sends in volume, and they help every sender.

## What each record does

| Record | What it says | Type and name |
| --- | --- | --- |
| **SPF** | "These servers are allowed to send mail for my domain." | `TXT` on `@` |
| **DKIM** | "Each message carries a signature you can check against this public key." | `TXT` on `<selector>._domainkey` |
| **DMARC** | "If a message fails SPF and DKIM, here's what to do with it, and where to send reports." | `TXT` on `_dmarc` |

## Before you start: where is your DNS?

- **DNS hosted by Web7 (in Enhance).** Check the DNS zone for your domain first. Some of these records may already be in place.
- **DNS at Cloudflare or your registrar.** You'll add the records there by hand, copying the values from the control panel.

## 1. Add an SPF record

A domain can have only **one** SPF record. If your email is hosted on your Web7 VPS, a simple record looks like this:

```
v=spf1 a mx ~all
```

If other services also send mail as your domain, add them to the **same** record instead of creating a second one. For example:

```
v=spf1 a mx include:_spf.google.com include:spf.protection.outlook.com ~all
```

SPF allows at most 10 DNS lookups, and each `include:` uses at least one, so remove services you no longer use.

## 2. Add the DKIM record

DKIM keys are generated per domain. Find your domain's email settings in the control panel and copy the DKIM record. Its name ends in `._domainkey` and its value starts with `v=DKIM1`. Add it as a `TXT` record exactly as shown.

> **Watch for truncation.** DKIM values are long. Some DNS editors split or trim them, so paste the whole value and check that it ends exactly as it does in the control panel.

## 3. Add a DMARC record

Start in monitoring mode, so nothing gets rejected while you check that everything passes:

```
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
```

Add it as a `TXT` record named `_dmarc`. Once the reports show your real mail passing for two to four weeks, tighten the policy to `p=quarantine`, then later to `p=reject`.

## 4. Test it

Send a message from your mailbox to a Gmail address, open it, and choose **Show original** from the message menu. You should see **SPF: PASS**, **DKIM: PASS** and **DMARC: PASS**. You can also send a test to a free checker such as mail-tester.com.

## Common mistakes

| Problem | Fix |
| --- | --- |
| Two SPF records | Merge them into one. Two records make SPF fail completely. |
| Website forms land in spam | Have WordPress send through an authenticated mailbox with an SMTP plugin, rather than PHP mail. |
| DKIM fails after moving DNS | The record didn't come across. Copy it again from the control panel. |
| DMARC record not found | The name must be `_dmarc`, not `_dmarc.example.com` typed into a field that already adds your domain. |

Email still not arriving? [Open a support ticket](https://my.web7tech.com/submitticket.php) with the sending address, the recipient and the time you sent it, and we'll trace it in the mail logs.