SPF, DKIM, and DMARC: The 2026 Email Authentication Setup Guide

Your emails can fail before anyone reads the subject line. In 2026, Gmail, Yahoo, and Microsoft reject or spam-folder mail that does not pass authentication, and the gap between compliant and non-compliant senders is brutal: authenticated senders average around 89% inbox placement, while unauthenticated ones can see a quarter to a third of their mail routed straight to spam. Setting up SPF, DKIM, and DMARC is no longer a nice-to-have for careful marketers. It is the price of admission.

The good news is that this is a one-time configuration for most senders, and you can finish it in an afternoon. The bad news is that a small mistake, like a misaligned domain or one too many DNS lookups, quietly breaks everything while looking fine on the surface. This guide walks through each record in order, shows you the exact values, and tells you where people go wrong.

What the 2026 rules actually require

Three mailbox providers now enforce the same baseline. Google and Yahoo started in February 2024, and Microsoft added its own enforcement for Outlook, Hotmail, and Live addresses in May 2025. France’s La Poste has since joined the group. The requirements converge on a short list.

Any domain sending 5,000 or more messages per day to Gmail addresses is permanently classified as a bulk sender, and once you cross that line the label sticks. Bulk senders must publish SPF, DKIM, and DMARC records, pass DMARC alignment, keep their spam complaint rate below 0.30% (Gmail’s own enforced target is closer to 0.10%), and include a one-click unsubscribe header. Smaller senders are not formally required to have all three, but the same filters judge everyone, so authenticated mail from a 400-subscriber list still lands better than unauthenticated mail.

Before you start: what you need

Gather these first so you are not switching contexts mid-setup:

• Access to your domain’s DNS settings. This is usually your registrar (Namecheap, GoDaddy, Cloudflare) or your hosting provider. You will be adding TXT and CNAME records.
• Admin access to your email marketing tool. You need to reach the domain authentication or sending domain section of its settings.
• A dedicated inbox or address for DMARC reports, such as dmarc@yourdomain.com. Reports arrive as XML, so a separate mailbox keeps them out of your way.
• Thirty minutes of patience for DNS propagation. Changes usually apply within an hour, but some providers take up to 48 hours.

A note on subdomains before you touch anything: send marketing email from a subdomain like news.yourdomain.com rather than your root domain. This isolates your marketing reputation from the address you use for real correspondence, so a rough sending week never threatens your business email. Every record below can be published on a subdomain.

Step 1: Set up SPF

SPF (Sender Policy Framework) is a public list of the mail servers allowed to send on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks this list.

Add a single TXT record to your DNS. The host is your domain (or subdomain), and the value comes from your email tool. It looks like this:

v=spf1 include:_spf.mailerlite.com ~all

The include points to your provider’s servers, and ~all (soft fail) tells receivers to treat unlisted servers with suspicion. If you send through more than one service — say a marketing tool plus a transactional provider plus your CRM — you combine them into one record:

v=spf1 include:_spf.mailerlite.com include:servers.mcsv.net include:sendgrid.net ~all

Publish only one SPF record per domain. Two SPF records is a configuration error that invalidates both.

Step 2: Set up DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. The receiving server uses a public key you publish in DNS to confirm the message genuinely came from your domain and was not altered in transit.

You do not generate the keys by hand. Your email platform creates a key pair, keeps the private key, and gives you a public key to publish. In most tools this appears as one or two CNAME records that point back to the provider, which lets them rotate keys without you touching DNS again. A typical record looks like:

Host:  mte1._domainkey.yourdomain.com
Type:  CNAME
Value: mte1.dkim.mailerlite.com

Add the records exactly as shown, including the trailing dots if your DNS provider requires them. Then return to your email tool and click its verify or authenticate button. The tool sends a test lookup and confirms the signature resolves. Do not skip this verification step, because a DKIM record with a single wrong character fails without any obvious error.

Step 3: Start with a monitoring DMARC policy

DMARC ties SPF and DKIM together. It tells receiving servers what to do when a message fails authentication and where to send reports. This is the record that actually satisfies the bulk sender requirement, and it is the one most likely to cause self-inflicted damage if you rush it.

Start in monitoring mode. Add a TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The p=none policy asks receivers to take no action on failures but to send you aggregate reports at the address in rua. For the first two to four weeks you are collecting evidence, not enforcing anything. The reports tell you which of your legitimate sending sources pass and which fail, so you can fix problems before they block real mail.

Step 4: Verify alignment

Passing SPF or DKIM is not enough on its own. DMARC also checks alignment, meaning the domain in your visible From address must match the domain that SPF or DKIM validated. A message can pass a raw SPF check and still fail DMARC because the authenticated domain was your provider’s, not yours.

This is exactly why you publish records on your own sending domain rather than relying on your email tool’s default shared domain. When you authenticate news.yourdomain.com and send from that address, SPF and DKIM validate your domain, alignment passes, and DMARC is satisfied.

Check your work before moving on. Send a test message to a Gmail account, open the message, and use “Show original” to see three green PASS lines for SPF, DKIM, and DMARC. A free checker such as Mail-Tester or the record lookups at MXToolbox will confirm your records resolve correctly and flag SPF lookup overruns.

Step 5: Tighten DMARC to enforcement

Once your monitoring reports show that every legitimate source passes authentication and aligns, raise the policy. Move to quarantine first:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Quarantine sends failing mail to spam rather than rejecting it outright, which gives you a safety margin. Watch your reports for another week or two. If nothing legitimate is landing in the failure bucket, move to full enforcement:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

At p=reject, mail that fails authentication is refused entirely. This is the strongest protection against spoofing and phishing that impersonates your brand, and it is the level that qualifies your domain for BIMI, which displays your logo next to your emails in Gmail and Apple Mail.

Common mistakes that quietly break authentication

Most authentication failures trace back to the same handful of errors:

• Two SPF records. Only one v=spf1 record is allowed per domain. A second one invalidates both. Merge them.
• Exceeding 10 SPF lookups. Stacking include statements for several tools pushes you over the limit and causes a silent permerror. Flatten or delegate to a subdomain.
• Authenticating the wrong domain. Setting up records for your root domain while sending from a subdomain (or the reverse) breaks alignment. Match the records to the exact From domain you send from.
• Publishing DMARC before the sources are ready. A premature p=reject blocks your own legitimate senders. Always start at p=none.
• Forgetting a sending source. Your marketing tool is rarely your only sender. Invoicing, help desk, calendar invites, and CRM email all send as your domain. Each needs its own SPF include and DKIM, or DMARC will fail them.
• Never reading the reports. The rua address exists for a reason. If you never look, you will not know a source is failing until deliverability drops.

What success looks like

You know authentication is working when three things are true. First, a “Show original” on a test message to Gmail shows SPF, DKIM, and DMARC all passing. Second, Google Postmaster Tools reports your domain reputation as high and shows near-100% authentication success. Third, your DMARC aggregate reports show only your intended sources sending as your domain, with everything aligned.

At that point your setup is stable. DKIM keys rotate automatically if you used CNAME records, DMARC keeps reporting, and you only revisit the configuration when you add a new sending tool. When you do add one, run it through the same three steps: SPF include, DKIM record, then confirm it appears cleanly in your DMARC reports.

Which tools make this easiest

Authentication depends far more on your DNS records than on your platform, but some tools reduce the friction considerably. The difference shows up in how clearly they present the records and whether they verify the setup for you.

MailerLite handles this about as well as any general marketing platform. Its domain authentication flow lays out the exact SPF and DKIM records, checks them for you, and flags problems in plain language. The free plan covers 250 subscribers and 2,500 emails a month, so you can authenticate a domain and test deliverability without paying, and paid plans start at $12 a month. The trade-off is that MailerLite’s automation is lighter than what a tool like ActiveCampaign offers, and support is chat and email only, with no phone line.

Postmark is the reference point for authentication and deliverability, especially for transactional mail like receipts and password resets. Its setup wizard is precise, it publishes its own deliverability metrics openly, and it enforces strict content rules that keep its shared infrastructure clean. The catch is that Postmark is deliberately narrow: it bans cold outreach, its content policies are tight, and it is not a full marketing platform, so most senders pair it with a separate marketing tool rather than using it alone.

The two are not really substitutes — MailerLite is a marketing platform, Postmark is a transactional sending API — so pick based on the job: broadcast campaigns and automation go to MailerLite, receipts and password resets go to Postmark. Whichever tool you choose, the records are the same standard, and moving between platforms mostly means swapping one SPF include and one set of DKIM records. For a wider look at platforms judged on inbox placement, see our best deliverability tools roundup, and if you are budgeting the switch, the MailerLite pricing breakdown shows what each tier costs. Authentication is only one piece of reaching the inbox — our email deliverability guide covers the reputation and content work that authentication alone cannot fix.

The bottom line

SPF, DKIM, and DMARC are not optional in 2026, and the setup is more forgiving than it looks as long as you go in order and resist the urge to skip the monitoring stage. Publish SPF, add DKIM, start DMARC at p=none, confirm alignment, then tighten to p=reject. Read your reports along the way. Do that once, on a dedicated sending subdomain, and you clear the bar that every major mailbox provider now enforces — and you protect your domain from the spoofing that authentication was built to stop.

Sources

1. Google — Email sender guidelines — accessed 2026-07-06
2. Google Postmaster Tools — accessed 2026-07-06
3. MailerLite — Official Website — accessed 2026-07-06
4. Postmark — Official Website — accessed 2026-07-06