Set up SPF, DKIM and DMARC for your own domain

What the three DNS records do, how to add them for Google Workspace or Microsoft 365, and how to check them before you send.

When you connect your own mailboxes, your own domain sends the email. Three DNS records tell receiving mail servers that this email really comes from you: SPF, DKIM and DMARC. Without them, more of your email lands in spam or is refused. Add all three before your first campaign.

Mailboxes you order through Argorant come with all three set up. We add them to the new domains as part of the order, so you can skip this article. See Order new mailboxes and domains.

What each record does

Record	What it does	Where it lives
SPF	Lists the mail servers that may send email for your domain.	One TXT record on the domain itself
DKIM	Adds a signature to every email. The receiver can check that the email came from your domain and was not changed on the way.	A TXT or CNAME record that your mail provider gives you
DMARC	Tells receivers what to do with email that fails SPF and DKIM, and where to send reports about it.	One TXT record on `_dmarc.yourdomain.com`

Argorant needs no record of its own. Your campaign emails leave through Google or Microsoft, so their records cover every email Argorant sends for you. You add the records where the DNS of your domain is managed, usually at the company where you bought the domain. Argorant cannot change them for you.

Google Workspace

You need a Google Workspace super admin and access to the DNS of your domain.

SPF. Add a TXT record on the domain itself (the host is often written as @) with this value: v=spf1 include:_spf.google.com ~all
DKIM. In the Google Admin console, open Apps, Google Workspace, Gmail, then Authenticate email. Pick your domain and click Generate new record. Google shows a TXT record with the host google._domainkey and a long value. Add it to your DNS exactly as shown.
Back in Authenticate email, click Start authentication. If Google cannot find the record yet, wait an hour and try again.
DMARC. Add a TXT record with the host _dmarc and this value. Put an address you read in place of the example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Microsoft 365

You need a Microsoft 365 admin and access to the DNS of your domain.

SPF. Add a TXT record on the domain itself with this value: v=spf1 include:spf.protection.outlook.com ~all
DKIM. In the Microsoft Defender portal, open Email & collaboration, Policies & rules, Threat policies, Email authentication settings, then the DKIM tab. Click your domain. If Microsoft offers to create DKIM keys, do that first. Microsoft then shows two CNAME records, selector1._domainkey and selector2._domainkey, with the values for your domain. Add both to your DNS exactly as shown.
Back on your domain in the DKIM tab, switch Sign messages for this domain with DKIM signatures on. If Microsoft cannot find the records yet, wait an hour and try again.
DMARC. Add the same TXT record as for Google: host _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Other mail providers work the same way. Ask your provider for its SPF include and its DKIM record, then add the DMARC record above.

Check that it works

DNS changes can take from a few minutes up to 48 hours to show everywhere. Look the records up from a terminal on Windows, Mac or Linux. Replace yourdomain.com with your domain.

nslookup -type=txt yourdomain.com
nslookup -type=txt _dmarc.yourdomain.com

For DKIM, look up google._domainkey.yourdomain.com as TXT on Google Workspace, or selector1._domainkey.yourdomain.com as CNAME on Microsoft 365.

Then send a normal email from the connected mailbox to a Gmail address you can open. In Gmail, open the email, click the three dots and choose Show original. SPF, DKIM and DMARC should all say PASS.

Start DMARC with p=none. It only reports and blocks nothing. Once SPF and DKIM pass for a few weeks, you can change it to p=quarantine.

Common mistakes

Two SPF records on one domain. A domain may have only one. If a record that starts with v=spf1 already exists, add the include to that record instead of creating a second one.
Forgetting other senders. A newsletter tool, a help desk or your website may also send email for the domain. Their includes go into the same SPF record.
DKIM in DNS, but not switched on. The record does nothing until you click Start authentication in Google or switch signing on in Microsoft.
Starting DMARC with p=reject. A small mistake in SPF or DKIM then blocks real email. Start with p=none.
Sending cold email from your main company domain. If those emails get flagged, your normal email suffers too. Use a separate domain for outreach, with its own three records.

The records make your email trusted, but a new mailbox still needs a slow start. Switch on warm-up and keep the daily sending limit low at first.