1. What each record does
- SPF — lists which servers are allowed to send for your domain
- DKIM — adds a cryptographic signature so receivers can verify the message was not altered
- DMARC — tells receivers what to do if SPF/DKIM fail, and can send reports
2. Before you start
- Know every system that sends mail for your domain (mail server, ESP, Office 365, Google, etc.)
- Have access to your DNS panel
- Prefer one clear sending strategy — too many random sources hurt trust
3. Create an SPF record
- Add a TXT record on yourdomain.com
- Simple example if only your server sends: v=spf1 ip4:YOUR.SERVER.IP -all
- If using Google: include:_spf.google.com
- If using Microsoft 365: include:spf.protection.outlook.com
- Keep only one SPF TXT record per domain
- Use ~all while testing, then move to -all when confident
4. Create a DKIM record
- Generate DKIM keys on your mail platform (Postfix/OpenDKIM, Zimbra, Google, Microsoft, etc.)
- Publish the public key as a TXT record, usually selector._domainkey.yourdomain.com
- Enable DKIM signing on the sending service
- Send a test and check that DKIM=pass
5. Create a DMARC record
- Add TXT on _dmarc.yourdomain.com
- Starter example: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
- Monitor reports for 1–2 weeks
- Then tighten policy to quarantine or reject when clean
6. How to test
- Send mail to Gmail/Outlook and open original headers
- Confirm spf=pass, dkim=pass, dmarc=pass
- Use mail-tester style tools for a quick score check
- Fix failures before increasing send volume
7. Common mistakes
- Multiple SPF records on the same domain
- Forgetting a sending provider in SPF includes
- DKIM selector mismatch
- Jumping to p=reject too early
8. Where a mailer fits
DNS auth protects domain trust. A campaign tool like Px Mailer handles personalization, attachments, rotation, and send workflows. Use both. Px Mailer: https://pxtoolx.com
