The 2026 Enterprise Engineering Blueprint for SPF DKIM DMARC: Enterprise Architecture Playbook [2026]

To set up email authentication, publish an SPF record that lists every service allowed to send for your domain, turn on DKIM signing in each of those services, then publish a DMARC record at p=none and read the reports. Once every legitimate source passes and aligns with your From domain, move DMARC to quarantine and then reject. Doing it in this order stops spoofing without blocking your own mail.

What do SPF, DKIM and DMARC each do?

• SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for a domain. The receiving server checks the connecting IP against it.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiver fetches your public key from DNS and confirms the message was not altered.
• DMARC tells receivers what to do when a message fails, and sends you reports. It also requires alignment: the domain that passed SPF or DKIM must match the domain in the visible From address.

Google requires all three for anyone sending more than 5,000 messages a day to Gmail accounts, and Yahoo publishes similar sender requirements.

Step 1: List every service that sends as your domain

Before touching DNS, write down every system that sends email with your domain in the From address: your mailbox provider, your CRM, your marketing tool, your help desk, invoicing and any app that sends notifications. Missing one here is the most common reason a DMARC rollout blocks real mail.

Step 2: Publish one SPF record

1. Create a single TXT record on the root domain that starts with v=spf1. A domain must have only one SPF record.
2. Add an include: for each sending service, using the value from that service's documentation.
3. End with ~all while testing, and consider -all once DMARC reports look clean.
4. Keep under the limit of 10 DNS lookups set by the SPF standard. Too many includes cause a permanent error, which counts as a failure.

Step 3: Turn on DKIM for each sender

Each sending service gives you a selector and a public key, usually as a TXT or CNAME record. Publish it, then switch signing on in the service. Use 2048-bit keys where the service allows it, and make sure the signing domain is your domain, not the provider's, so DKIM aligns.

Step 4: Publish DMARC at p=none

Add a TXT record at _dmarc.yourdomain, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Nothing is blocked at this stage. Receivers start sending aggregate reports that show which sources send as you and whether they pass and align.

Step 5: Read the reports and fix every source

Aggregate reports are XML files, so use a report viewer or parser. For each sending source, confirm it passes SPF or DKIM and aligns. Fix gaps in the service's settings, not by loosening the policy. Expect to spend a few weeks here, because some systems send only monthly.

Step 6: Move to quarantine, then reject

When the reports show only legitimate, aligned mail, change to p=quarantine. You can use the pct tag to apply it to part of the traffic first. After another clean period, move to p=reject. Keep reading reports: a new tool added later will show up there first.

Common mistakes

• Two SPF records on the same domain, which makes SPF fail.
• DKIM signed with the provider's domain, so DMARC alignment fails even though DKIM passes.
• Jumping straight to p=reject and blocking invoices or CRM emails.
• Forgetting subdomains that send mail; they inherit the DMARC policy unless an sp tag says otherwise.

Frequently asked questions

Do I need all three?

Yes, if you send in volume. SPF and DKIM prove who sent the message; DMARC ties them to your From domain and tells receivers how to act.

How long does DNS take?

Usually minutes to a few hours, depending on the TTL of the record.

Does DMARC improve inbox placement by itself?

It removes a reason to filter your mail, but placement also depends on complaints, engagement and list quality.

Sources

• RFC 7208: Sender Policy Framework (SPF)
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
• RFC 7489: DMARC
• Google: Email sender guidelines
• Yahoo Sender Hub: best practices

Need help with this?

Insyrge sets up and audits email authentication so your messages reach the inbox.

Talk to Insyrge See workflow automation services

Related resources

• Zoho API and third-party integration services: Connect your CRM to the rest of your stack.
• DMARC Setup: SPF, DKIM and Policy Step by Step