Complete Guide to Setting Up DMARC & SPF Records for Better Email Deliverability
Sovereign Engineering Team | 2026-06-14 | 4 min read
## Introduction to Email Deliverability & DNS Configuration
When managing a domain for your organization, website, or marketing campaigns, email deliverability is a key metric. Despite producing world-class content, your emails might end up in the spam folder if your domain isn't properly authenticated.
Modern inbox providers like Google Workspace and Outlook require strict validation protocols. In this guide, we'll explain how you can set up **Sender Policy Framework (SPF)** and **Domain-based Message Authentication, Reporting, and Conformance (DMARC)** records directly in your DNS settings to ensure your emails bypass spam filters perfectly.
---
## Understanding SPF (Sender Policy Framework)
SPF is a DNS record that lists which IP addresses and services are authorized to send emails on behalf of your domain. If an email arrives from a server not listed in your SPF record, the receiving mail server will flag it as suspicious.
### Step 1: Locate your Mail Provider's Include Statement Whether you are using Google Workspace, Microsoft 365, Mailgun, or SendGrid, they will provide you with a specific SPF string. Example for Google Workspace: `include:_spf.google.com`
### Step 2: Create a TXT Record in your DNS Log into your domain registrar (e.g., Cloudflare, Namecheap, GoDaddy) and navigate to the DNS management zone. - **Type:** TXT - **Name/Host:** `@` (or your root domain) - **Value/Content:** `v=spf1 include:_spf.google.com ~all`
*Pro-tip: Only have ONE SPF record per domain. Multiple SPF records will cause validation failures. Combine includes if you use multiple services: `v=spf1 include:_spf.google.com include:sendgrid.net ~all`*
---
## Understanding DMARC
Once SPF (and DKIM) are in place, DMARC tells the receiving mail server what to do if an email *fails* those authentication checks. DMARC gives domain owners control over spoofing and phishing attempts.
### Setting Up the DMARC Record Create another TXT record in your DNS settings. - **Type:** TXT - **Name/Host:** `_dmarc` - **Value/Content:** `v=DMARC1; p=none; rua=mailto:admin@yourdomain.com;`
### The `p=` (Policy) Tag Explained - `p=none`: Monitor only. Deliver the email but send a report. Start here to watch for issues. - `p=quarantine`: Send failing emails to the spam/junk folder. - `p=reject`: Completely block failing emails from being delivered.
### Moving to Reject Mode We recommend starting with `p=none`. After monitoring your DMARC reports for a few weeks and confirming that all legitimate emails are passing SPF and DKIM, update your record to `p=quarantine` and eventually `p=reject` to lock down your domain security.
---
## Conclusion
By taking 10 minutes to properly configure your DNS records, you establish a professional, verifiable domain identity. Your outbound communications will reliably reach your customers, protecting both your sender reputation and brand equity.
When managing a domain for your organization, website, or marketing campaigns, email deliverability is a key metric. Despite producing world-class content, your emails might end up in the spam folder if your domain isn't properly authenticated.
Modern inbox providers like Google Workspace and Outlook require strict validation protocols. In this guide, we'll explain how you can set up **Sender Policy Framework (SPF)** and **Domain-based Message Authentication, Reporting, and Conformance (DMARC)** records directly in your DNS settings to ensure your emails bypass spam filters perfectly.
---
## Understanding SPF (Sender Policy Framework)
SPF is a DNS record that lists which IP addresses and services are authorized to send emails on behalf of your domain. If an email arrives from a server not listed in your SPF record, the receiving mail server will flag it as suspicious.
### Step 1: Locate your Mail Provider's Include Statement Whether you are using Google Workspace, Microsoft 365, Mailgun, or SendGrid, they will provide you with a specific SPF string. Example for Google Workspace: `include:_spf.google.com`
### Step 2: Create a TXT Record in your DNS Log into your domain registrar (e.g., Cloudflare, Namecheap, GoDaddy) and navigate to the DNS management zone. - **Type:** TXT - **Name/Host:** `@` (or your root domain) - **Value/Content:** `v=spf1 include:_spf.google.com ~all`
*Pro-tip: Only have ONE SPF record per domain. Multiple SPF records will cause validation failures. Combine includes if you use multiple services: `v=spf1 include:_spf.google.com include:sendgrid.net ~all`*
---
## Understanding DMARC
Once SPF (and DKIM) are in place, DMARC tells the receiving mail server what to do if an email *fails* those authentication checks. DMARC gives domain owners control over spoofing and phishing attempts.
### Setting Up the DMARC Record Create another TXT record in your DNS settings. - **Type:** TXT - **Name/Host:** `_dmarc` - **Value/Content:** `v=DMARC1; p=none; rua=mailto:admin@yourdomain.com;`
### The `p=` (Policy) Tag Explained - `p=none`: Monitor only. Deliver the email but send a report. Start here to watch for issues. - `p=quarantine`: Send failing emails to the spam/junk folder. - `p=reject`: Completely block failing emails from being delivered.
### Moving to Reject Mode We recommend starting with `p=none`. After monitoring your DMARC reports for a few weeks and confirming that all legitimate emails are passing SPF and DKIM, update your record to `p=quarantine` and eventually `p=reject` to lock down your domain security.
---
## Conclusion
By taking 10 minutes to properly configure your DNS records, you establish a professional, verifiable domain identity. Your outbound communications will reliably reach your customers, protecting both your sender reputation and brand equity.