SPF, DKIM and DMARC explained for Indian businesses

Why SPF, DKIM and DMARC decide where your email lands

SPF, DKIM and DMARC are three short text records in your domain's DNS. Together they let Gmail, Yahoo, Outlook and other mailbox providers check that an email claiming to be from yourdomain.in really came from you. Without them, email deliverability suffers: genuine messages go to spam or bounce, and anyone can send email that pretends to be from your business.

Since 2024, Gmail and Yahoo have required bulk senders to authenticate with all three, to offer one-click unsubscribe, to act on unsubscribe requests promptly and to keep the spam complaint rate below 0.3%. Gmail also expects every sender, however small, to have at least SPF or DKIM in place.

SPF: who may send for your domain

SPF (Sender Policy Framework) is a TXT record on your domain that lists the services allowed to send email for it. For a business on Google Workspace it looks like this:

v=spf1 include:_spf.google.com ~all

In plain words: "This is an SPF record. Google's mail servers may send for this domain. Treat mail from anywhere else with suspicion." The ending ~all is a soft fail; -all asks receivers to refuse mail from any other server. Microsoft 365, Zoho Mail and most newsletter and outreach tools publish their own include value in their help pages.

Three rules catch people out:

• One SPF record per domain. If you also send through an outreach tool or your website's server, add its include to the same record. Two separate SPF records make SPF fail.
• No more than ten DNS look-ups. Each include uses at least one, so remove services you have stopped using.
• SPF checks the hidden return address, not the From line people see. DMARC is what connects it to the visible sender.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) puts a digital signature on each email. Your mail provider signs outgoing messages with a private key; you publish the matching public key in DNS; the receiving server checks that the signature fits and that the message was not altered on the way.

The record sits on a name made of a selector and _domainkey. Google Workspace uses the selector google by default, so its record goes at google._domainkey.yourdomain.in and holds text such as v=DKIM1; k=rsa; p=MIIBIjANBgkq..., where the long string after p= is the public key. Microsoft 365 uses two CNAME records instead, and other providers give you their own record to copy.

A common trap: Google Workspace signs your mail with a Google domain until an administrator generates your own key in the Admin console, under Gmail's "Authenticate email" setting, publishes it in DNS and clicks "Start authentication". Until then DKIM passes for Google's domain, not yours, which does not help DMARC.

DMARC: the policy that ties them together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that fails, and asks them to send you reports. It is a TXT record at _dmarc.yourdomain.in:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.in

In plain words: "This is a DMARC record. For now, take no action on failures. Send summary reports to this mailbox."

DMARC passes only when SPF or DKIM passes for the same domain that appears in the From line. This alignment is what stops a spammer who passes SPF for his own domain from putting your domain in the From line.

The policy has three settings: p=none (only report), p=quarantine (send failures to spam) and p=reject (refuse them). Gmail and Yahoo accept p=none from bulk senders, but a stricter policy gives you more protection against people faking your domain.

Setting up SPF, DKIM and DMARC in the right order

1. List everything that sends as your domain. Your mailbox provider, plus the ones people forget: the website's contact form, the accounting or billing software that emails invoices, a CRM, a newsletter tool and any outreach tool.
2. Find where your DNS is managed. Usually at your domain registrar, such as GoDaddy, BigRock or Hostinger, or at a service such as Cloudflare. The records are added there, not in your mailbox.
3. Publish one SPF record that covers every sender on your list.
4. Turn on DKIM for each sender that supports it, using the record each one gives you.
5. Add DMARC at p=none and read the reports for a few weeks. They arrive as XML files; a DMARC report service turns them into a readable summary.
6. Fix the failures, then tighten to p=quarantine and later to p=reject.
7. Test. Send a message to a Gmail address, open it and choose "Show original" from the menu. It shows SPF, DKIM and DMARC as PASS or FAIL.

Picture a Pune engineering firm that sets DMARC straight to p=reject. The next week, invoices from its billing software stop reaching customers, because the software sends from its own servers without the firm's DKIM key. Starting at p=none would have shown that sender failing in the first reports.

Passing the checks is the start

Authentication proves who you are. It does not make people want your email. Mailbox providers also watch how recipients react.

• Put a one-click unsubscribe in anything promotional, and act on it quickly.
• Watch your spam complaint rate in Google Postmaster Tools and keep it far below 0.3%.
• Many senders use a separate subdomain, such as mail.yourdomain.in, for outreach, with its own SPF, DKIM and DMARC, so that one bad campaign does not hurt the mailbox your invoices come from.
• Send only to addresses you have checked. Our guide to business email lists covers verifying a list and sending in small batches, and the cold email templates show what to write. Every Starleads list shows the share of contacts with an email address before you buy.

Questions people ask

I send only 30 emails a day. Do I still need all three?

Yes. Gmail expects every sender to have SPF or DKIM, and a DMARC record at p=none makes your domain harder to fake. For most small businesses it is a short job.

Can DMARC stop my own emails being delivered?

Not at p=none, which only collects reports. Quarantine and reject act on failures, which is why you move to them only after the reports show every genuine sender passing.