SPF, DKIM and DMARC are small text records in your domain's DNS. They prove to the receiving server that your email really comes from you.
Transcript
- SPF, DKIM and DMARC prove your email really comes from you.
- Open Settings, then Deliverability.
- Each domain shows what passes. Here SPF is missing, so sending is blocked.
- SPF lists who may send for you. DKIM signs each email. DMARC handles fakes.
- The records to add are listed. Press Copy for each value.
- Pick where your domain is managed for short steps.
- Add the record at your DNS provider, then come back.
- Press "Run checks again". SPF now passes.
- Changes can take from minutes up to 48 hours to show.
The three records in plain words
| Record | What it does | Required by Outvori |
|---|---|---|
| SPF | Lists who may send email for your domain | Yes - sending is blocked without it |
| DKIM | Your provider signs every email; the public key in DNS lets receivers check it | Yes - sending is blocked without it |
| DMARC | Tells receivers what to do with email that fails, and where to send reports | Recommended - a warning only |
Steps
- Open Deliverability. Each domain shows which records pass.
- Open Fix it step by step under the domain. The records to add are listed with Copy buttons.
- Pick where your domain's DNS is managed to see short steps for that host.
- Add the records at your DNS host.
- Back in Outvori, press Run checks again.
The values
- Google Workspace: SPF
v=spf1 include:_spf.google.com ~all. DKIM is generated in Google Admin console (Apps > Google Workspace > Gmail > Authenticate email) and published as TXT atgoogle._domainkey. - Microsoft 365: SPF
v=spf1 include:spf.protection.outlook.com -all. DKIM is two CNAME records,selector1._domainkeyandselector2._domainkey; copy their targets from the DKIM page in the Microsoft Defender portal. - Other providers: your mail host lists the SPF include and the DKIM key in its control panel.
- DMARC: start with
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comand tighten later, as Google recommends.
Steps per DNS host
- Cloudflare: DNS > Records > Add record. Use @ for the domain itself. Set DKIM CNAMEs to DNS only.
- GoDaddy: Domain Portfolio > domain > DNS > Add New Record. Type only the prefix in Name (for example
_dmarc). Most changes work within an hour, up to 48 hours. - Namecheap: Domain List > Manage > Advanced DNS > Add New Record. Do not include your domain in Host; Namecheap adds it.
- Squarespace Domains (formerly Google Domains): domain > DNS > DNS Settings > Custom Records > Add record. Squarespace adds your domain to Name automatically.
- one.com: Control Panel > DNS settings > DNS records > create new record. Leave Hostname empty for the domain itself.
- Loopia: Customer Zone > domain > DNS editor. Records are grouped by subdomain; @ is the domain itself.
Each step list in the app links to the host's own help page.
How long it takes
Usually minutes to an hour. Some hosts say up to 48 hours, and Google notes a new DKIM key can take up to 48 hours to start working. If a check says "lookup error", run the checks again before changing anything.
