SPF, DKIM and DMARC for Small Business Email: A Setup Guide

If your business emails land in spam, or someone else can send messages that look like they came from your domain, the fix usually starts in your DNS settings. Three records, SPF, DKIM and DMARC, tell receiving mail servers which senders to trust for your domain.

This guide walks through the setup in a safe order. It includes worked examples for Google Workspace and practical notes for Titan Business Email, and it applies to any small business that sends mail from its own domain.

Quick answer

What SPF, DKIM and DMARC each do

Each record answers a different question, and all three are published as TXT records in your domain's DNS.

DMARC ties the other two together. A message passes DMARC when it passes SPF or DKIM and the authenticated domain matches the domain in the visible From address. Google calls this matching requirement alignment.

Why small senders should care now

Gmail's sender guidelines have applied since February 1, 2024. Every sender to Gmail accounts needs SPF or DKIM, valid forward and reverse DNS for the sending IP address, a TLS connection, and a spam rate kept below 0.30% in Google Postmaster Tools. Google recommends staying below 0.10%.

Senders of more than 5,000 messages a day to Gmail must meet stricter rules: both SPF and DKIM, a DMARC policy (p=none is acceptable), a From domain that aligns with SPF or DKIM, and one-click unsubscribe for marketing and subscribed messages.

Yahoo asks all senders to use SPF or DKIM at a minimum. Bulk senders need both, plus a valid DMARC policy of at least p=none. Yahoo's page does not state a volume threshold for bulk.

Most small businesses send far fewer than 5,000 messages a day to Gmail, so the bulk rules may not strictly apply to you. A DMARC record is still worth publishing because it shows who sends mail as your domain. Passing authentication does not guarantee inbox placement, since content and sender reputation still matter.

Before you start

• List every service that sends email as your domain: your mailbox provider, website contact forms, invoicing tools, newsletter platforms and CRM systems.
• Find out where your domain's DNS is managed. You add the records there, and that may be your registrar, a separate DNS host or a hosting control panel.
• Confirm you have admin access to both DNS and your email provider. In Google Workspace, Google says you need super administrator access or at least the Gmail Settings privilege to generate a DKIM key.
• Create a dedicated mailbox or group to receive DMARC reports. Google notes reports can arrive in large volumes.
• Check for an existing SPF record, which is a TXT record starting with v=spf1. Edit it instead of adding a second one.

Step 1: Publish your SPF record

SPF is a single TXT record at your domain root that starts with v=spf1. Google's guidance says each domain must have its own SPF record. RFC 7208 section 4.6.4 limits an SPF check to 10 DNS-querying mechanisms and modifiers in total: include, a, mx, ptr, exists and redirect. Lookups inside the records you reference count toward that limit too, so a record with fewer than 10 direct include: entries can still exceed it and return a permerror.

If you send mail only through Google Workspace, Google's example record is:

v=spf1 include:_spf.google.com ~all

Google recommends ending the record with ~all. If you also send through other services, add the SPF setting each service tells you to use inside the same record, and verify the lookup count with an SPF checker after every change. Do not create a second SPF record, because two records for one domain can make SPF evaluation fail.

For Titan Business Email, copy the exact SPF value that Titan shows for your domain rather than typing it from memory or borrowing another provider's value. Titan's help center includes an article titled "What are SPF records and why are they important?" that explains the record.

Google notes that SPF changes can take up to 48 hours to propagate, although they often appear sooner.

Step 2: Turn on DKIM signing

DKIM needs two actions: publish the public key in DNS, then tell your email provider to start signing. In Google Workspace, the steps are:

1. In the Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email, and select your domain.
2. Click Generate New Record. Choose a 2048-bit key if your DNS provider supports it, or 1024-bit if it does not. Keep the default selector, google, unless your domain already uses a key with that prefix.
3. Copy the host name (for example google._domainkey) and the TXT value, which begins v=DKIM1; k=rsa; p=.
4. Add the TXT record at your DNS host. Some providers limit TXT length or append your domain automatically, so check how the saved record displays.
5. Wait for DNS to update. Google says DKIM can take up to 48 hours to start working.
6. Return to Authenticate email and click Start authentication.

If you only recently turned on Gmail, Google advises waiting 24 to 72 hours before generating the key. Generating it too early can return a "DKIM record was not created" error.

For Titan Business Email, follow Titan's "Set up DKIM Record" help article and use the host name and value Titan generates for your domain. The comparison table on the Titan Business Email page includes a "Custom DKIM support" row, so confirm what your chosen plan includes before you rely on it.

Step 3: Add DMARC, starting in monitoring mode

Google recommends setting up SPF and DKIM first and confirming that authentication has worked for at least 48 hours before you add DMARC. Then create a TXT record with the host name _dmarc and a value like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Replace the address with your own report mailbox. The tags work as follows:

• v and p must come first. The p tag sets the policy you request: none is a monitoring policy that does not ask receivers to quarantine or reject mail based on DMARC, quarantine asks them to treat failing mail as suspicious, such as by filtering it to spam, and reject asks them to refuse it. The receiving server makes the final decision under its own policies.
• rua is where aggregate reports go. Each address needs the mailto: prefix. If the address is on a different domain, that domain needs its own DNS record to accept the reports.
• pct is optional. It sets the percentage of failing messages the policy applies to, and Google recommends including it during rollout.

Start with p=none so you can see which services send as your domain and whether they pass. Once every legitimate sender passes consistently, move to quarantine and then reject. Gmail does not support ruf (failure) reports, so rely on rua.

Test the result

1. Send a test message from each service that sends as your domain to a Gmail address.
2. Open the message in Gmail, choose Show original, and look at the Authentication-Results header. Google points to this header as the place to confirm a DKIM pass, and you can check SPF and DMARC there as well.
3. Run your DMARC record through a free online DMARC checker to confirm the format is valid.
4. Review your first DMARC reports after a few days. If a legitimate sender fails, fix its SPF or DKIM setup before you tighten the policy.

Common mistakes to avoid

Titan Business Email or Google Workspace?

Both products are offered on the Z.com US store, and the authentication steps follow the same pattern. The difference is where you generate the values: the Google Admin console for Google Workspace, or Titan's control panel for Titan Business Email. You can review each option on the Titan Business Email page and the Google Workspace page. Your DNS records stay with whichever service hosts your domain's DNS.

Frequently asked questions

Key takeaways

Official references

Requirements were checked against these pages on October 29, 2026. Providers can change their rules, so confirm current details before you publish records.

• Google: Email sender guidelines
• Google Workspace: Set up SPF
• Google Workspace: Set up DKIM
• Google Workspace: Set up DMARC
• Yahoo: Sender best practices