How do I set up SPF DKIM and DMARC for a transactional email domain?

Setting up SPF, DKIM, and DMARC for a transactional email domain is mostly about proving to receiving mail servers that your messages are authorized and haven’t been tampered with.

Here’s a practical setup guide.

---

1) SPF: authorize who can send for your domain

SPF is a DNS TXT record that lists which mail servers/services are allowed to send email on behalf of your domain.

Example

If you send transactional mail through a provider like SendGrid, Postmark, Mailgun, Amazon SES, etc., they’ll give you an SPF include value.

A typical SPF record looks like:

v=spf1 include:sendgrid.net -all

Or if you send through multiple services:

v=spf1 include:sendgrid.net include:spf.mailgun.org -all

Important notes

• You should have only one SPF record per domain.
• Keep it under the SPF lookup limit (10 DNS lookups).
• Use -all once you’re confident the list is complete.
• If you’re not sure yet, you can start with ~all (soft fail), then move to -all.

---

2) DKIM: cryptographically sign your messages

DKIM adds a digital signature to outgoing messages. The recipient verifies it using a public key in DNS.

How it works

• Your email provider gives you:
  • a selector (e.g. s1, k1, 2024)
  • a public key to publish in DNS
• Your provider signs outgoing messages with the matching private key

Example DNS record

A DKIM TXT record often looks like:

s1._domainkey.yourdomain.com TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B..."

Notes

• Use 2048-bit keys if your provider supports them.
• Many providers support multiple selectors so you can rotate keys without downtime.
• Make sure your “From” domain aligns with the domain used in DKIM signing where possible.

---

3) DMARC: tell receivers what to do if SPF/DKIM fail

DMARC builds on SPF and DKIM. It lets you:

• specify who should receive reports
• define enforcement policy if authentication fails

Start with monitoring

A common first DMARC record is:

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; adkim=s; aspf=s"

Policy options

• p=none — monitor only
• p=quarantine — suspicious mail may go to spam
• p=reject — reject failing mail

Suggested rollout

1. Start with p=none for a couple weeks
2. Review reports
3. Fix any legitimate senders that fail SPF/DKIM
4. Move to p=quarantine
5. Then to p=reject when confident

---

4) Alignment matters

DMARC passes when either:

• SPF passes and the SPF authenticated domain aligns with the visible From domain, or
• DKIM passes and the DKIM signing domain aligns with the visible From domain

For transactional mail, it’s best to send from a domain/subdomain you control, such as:

• notifications.example.com
• mail.example.com

This makes alignment easier and avoids conflicting with marketing or corporate mail.

---

5) Recommended setup for transactional email

For a transactional domain like notify.example.com, a good setup is:

SPF

notify.example.com TXT "v=spf1 include:your-email-provider.com -all"

DKIM

Your provider gives you records like:

selector1._domainkey.notify.example.com TXT "v=DKIM1; k=rsa; p=..."

DMARC

_dmarc.notify.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

Later:

_dmarc.notify.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com"

---

6) Common mistakes to avoid

• Having multiple SPF records
• Exceeding SPF DNS lookup limits
• Publishing DKIM in the wrong hostname format
• Using a From address that doesn’t align with SPF/DKIM
• Setting DMARC to reject before checking reports
• Forgetting third-party services that also send as your domain
• Using the root domain for both human email and transactional email without planning alignment

---

7) Verify everything

After publishing DNS:

• Use tools like:
  • MXToolbox
  • dmarcian
  • EasyDMARC
  • Google Admin Toolbox CheckMX
• Send test emails to Gmail/Outlook and inspect headers
• Confirm:
  • SPF: PASS
  • DKIM: PASS
  • DMARC: PASS

---

8) Best-practice template

For a transactional subdomain:

SPF

v=spf1 include:provider.example -all

DKIM

selector._domainkey.notify.example.com TXT "v=DKIM1; k=rsa; p=..."

DMARC

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

Then later transition to:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

and finally:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

---

If you tell me which email provider you’re using (e.g. SES, SendGrid, Mailgun, Postmark, Microsoft 365, Google Workspace), I can give you the exact DNS records to add.