SPF, DKIM and DMARC Setup Guide for Singapore SMEs

Quotations, invoices, password resets and customer replies all depend on one thing: your email reaching the inbox and being trusted when it gets there. For many Singapore SMEs, the first sign of a problem is a customer saying, "I never received your email," or worse, "I received a strange email that looked like it came from you."

SPF, DKIM and DMARC are the three DNS-based standards that address both problems. This guide explains what each one does, how they fit together, and how to roll them out and test them without disrupting the email your business already sends. Authentication helps receivers trust your mail, but it does not guarantee inbox placement.

What SPF, DKIM and DMARC each do

The three records answer different questions, which is why using only one of them leaves gaps.

SPF: the list of approved senders

An SPF record is a single TXT record that starts with v=spf1, followed by mechanisms such as ip4, mx and include, and ends with a rule for everything else. A -all ending states that unlisted hosts are not authorised, while ~all is a softer signal that they probably are not. SPF validates the envelope sender, not the From address your customer sees, which is one reason DMARC exists.

DKIM: a signature that travels with the message

With DKIM, your mail system signs outgoing messages with a private key. Receivers fetch the matching public key from DNS using the selector named in the signature, for example selector1._domainkey.yourdomain.com. Because selectors are separate, you can run several keys at once, one per sending service, and rotate them without touching the others. A valid signature shows the signed content has not been altered; it does not encrypt the message.

DMARC: the policy and the reporting

DMARC passes when SPF or DKIM passes and the domain used in that check aligns with the From domain. With the default relaxed alignment, a subdomain of the same organisational domain aligns; strict alignment requires an exact match. The p= tag sets the policy: none only monitors, quarantine asks receivers to treat failing mail as suspicious, and reject asks them to refuse it. The rua= tag names where aggregate reports are sent. The current DMARC specification, RFC 9989, supersedes RFC 7489 and removes the pct= tag, so build confidence through monitoring and reports rather than a percentage-based rollout.

Why this matters for a Singapore SME

Smaller businesses often send from several places at once: a mailbox host, a newsletter tool, an invoicing or accounting system, a CRM, and website contact forms. Each is a separate sender that must be authorised. If one is missing from SPF and has no DKIM key, its messages may fail DMARC the day you tighten your policy.

The reverse risk is spoofing. A domain with no DMARC policy gives receivers no instruction when someone forges your address, which matters when customers act on payment or delivery emails that appear to come from you. This guide covers the technical standards only; if you handle personal data in email, check your own obligations separately.

Step-by-step setup

Step 1: Inventory every sender

Before changing DNS, list every system that sends mail using your domain. Ask each team, and check your newsletter, billing, helpdesk and website form settings.

• Your main mailbox or email hosting platform
• Marketing or newsletter tools
• Invoicing, accounting or e-commerce platforms
• CRM, helpdesk and booking systems
• Website forms and any application servers that send notifications

Step 2: Find where your DNS is managed

Your DNS records are edited wherever your domain's nameservers point, which may be your registrar, your hosting control panel or a separate DNS provider. Confirm this first, because records added in the wrong place will not take effect.

Step 3: Publish one SPF record

Collect the SPF instructions from each sender's documentation, usually an include: value, and merge them into a single record. A domain must have only one SPF record; multiple records cause an error. SPF is also limited to 10 DNS-lookup terms per evaluation, so avoid piling on includes you no longer use. Start with ~all if you are unsure you have found every sender, and move to -all once you are confident.

Step 4: Enable DKIM for each sender

Follow each sending platform's DKIM instructions. Providers differ: some give you a TXT record containing a public key, while others give CNAME records that point to keys they manage. Use the exact record type, hostname and value provided, since a small typo means the signature cannot be verified, and follow the provider's activation sequence, as some require DNS verification before signing is switched on. Check whether your mail platform supports custom-domain DKIM before relying on it; on Z.com Singapore's Titan Business Email page, custom DKIM support is listed in the feature table.

Step 5: Add DMARC in monitoring mode

Create a TXT record at _dmarc.yourdomain with a monitoring policy and a report address you actually read. A starting point looks like this: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. Replace the domain and address with your own. Reports usually arrive as daily XML summaries, so use a reporting tool or a shared mailbox someone checks.

Step 6: Review, fix and tighten

Before tightening anything, test your setup:

• Verify the published SPF, DKIM and DMARC records in DNS.
• Send test messages from every legitimate service in your inventory.
• Inspect the authentication results in the recipient's message headers.
• Confirm at least one aligned SPF or DKIM pass, which is what DMARC requires.

Keep monitoring through normal sending cycles, such as monthly newsletters or billing runs, and fix legitimate senders that fail alignment first. When results are clean, move to p=quarantine, and later to p=reject. Keep the sp= tag in mind if you want a different policy for subdomains. Passing authentication does not guarantee inbox placement, which also depends on content, sender reputation and the receiver's own filters.

Common mistakes to avoid

Where your email platform fits in

Whichever platform hosts your mailboxes, check its documentation for the exact SPF include value and DKIM steps, because they differ by provider. Z.com Singapore's Unlimited Email Hosting page lists cPanel, webmail, spam protection and virus protection, with storage-based plans. It does not describe SPF, DKIM or DMARC specifics, so confirm those details with the Z.com Singapore support team before you configure DNS. If you are comparing options, the Titan Business Email and Google Workspace pages show the other business email choices.

Frequently asked questions