SPF, DKIM and DMARC setup serviceStop your emails landing in spam, in 2 days.
SPF, DKIM and DMARC set up and verified for your domain and every tool that sends as you.
Done by Parish Khan, senior developer since 2013
Updated
Fixed price
$290
Delivered in 2 business days after payment
- SPF, DKIM and DMARC set up and aligned
- Your mailbox provider plus up to 3 sending tools
- DMARC reports in a readable dashboard
- Gmail, Yahoo and Outlook sender rules covered
- Verified with real test emails
Passing, or a full refund. No payment until I confirm your brief.
- creators use frontends I built at Artlist and Artgrid
- 10M+
- creators use frontends I built at Artlist and Artgrid
- the year I started shipping for the web
- 2013
- the year I started shipping for the web
- products delivered for clients in 15+ countries
- 50+
- products delivered for clients in 15+ countries
- clients, with a 5-star average on Upwork and Fiverr
- 100+
- clients, with a 5-star average on Upwork and Fiverr
Works with
Google Workspace
- Microsoft 365
Zoho Mail
- Any website
What changes after delivery
Right now
- Clients tell you your invoices and replies ended up in spam.
- Gmail or Outlook bounced your newsletter with an authentication error.
- You are not sure which tools are allowed to send email as your domain.
After delivery
- Your emails pass SPF, DKIM and DMARC at Gmail, Yahoo and Outlook.
- Scammers can no longer easily send email pretending to be you.
- Daily DMARC reports show exactly who sends email as your domain.
SPF, DKIM and DMARC checker
Enter your domain to check its email authentication live, with a plain-English list of what to fix.
I fix SPF, DKIM and DMARC for your domain and up to three sending tools, verified with real test emails, for a fixed $290.
Everything included for $290
DNS audit
Every email record on your domain checked, and every service that sends email as you identified.
SPF, fixed
One merged SPF record covering all your senders, under the 10-lookup limit that silently breaks many setups.
DKIM everywhere
Signing turned on for your mailbox provider and up to 3 sending tools, with 2048-bit keys where supported.
DMARC with reports
A DMARC record in monitoring mode, with daily reports flowing into a free dashboard you can actually read.
Bulk-sender checklist
Gmail, Yahoo and Microsoft requirements checked, including one-click unsubscribe on marketing emails.
Verified with real sends
Test emails to Gmail and Outlook, with the headers checked for SPF, DKIM and DMARC passes.
Enforcement plan
A written, step-by-step plan to move DMARC to quarantine and then reject, without losing real email.
Plain-English report
What was wrong, what changed, and exactly what to do when you add a new email tool.
Not included
- Cleaning email lists or rewriting campaign content.
- Recovering a damaged sender reputation. I diagnose it, but recovery takes weeks of good sending.
- Buying a mark certificate for BIMI.
- Setting up a new mailbox provider or migrating mailboxes.
- A second domain. It is an add-on below.
What I need from you
- Access to your DNS (Cloudflare, GoDaddy, Namecheap and so on), or someone who can add records.
- Admin access to your mailbox provider, like Google Workspace or Microsoft 365.
- A list of tools that send email as you: newsletters, CRM, website forms, invoices.
What happens to your email before the inbox
Every receiving server asks three questions. Fail them and your email lands in spam, or is rejected outright.
Your email
From: hello@yourbusiness.com
Arrives at Gmail, Outlook or Yahoo, which run three checks before deciding where it goes.
1. SPF
Is this server allowed to send for yourbusiness.com?
Checks the sending server against your SPF record.
2. DKIM
Was it really signed by the domain, and unchanged?
Verifies the signature with your public key in DNS.
3. DMARC
Does SPF or DKIM match the From address?
Then applies your policy if it does not.
Inbox
Passes and aligns
Spam folder
Fails, with p=quarantine, or a poor reputation
Rejected
Fails, with p=reject, or missing rules at bulk volume
The safe DMARC rollout never jump straight to reject
p=noneWeek 0Monitor only. Reports show every sender.
p=quarantineWeeks 2 to 4Failures go to spam once real mail passes.
p=rejectWeeks 4 to 8Spoofed mail is refused outright.
How delivery works
- Day 0
Order and brief
You order and list the tools that send as you. I confirm the brief and send the invoice. Work starts when payment lands.
- Day 1
Audit and fix
DNS audit, every sender identified, and SPF, DKIM and DMARC records published.
- Day 2
Verify
Test emails to Gmail and Outlook, header checks, your report and the enforcement plan.
- Weeks 2 to 4
Monitor
DMARC reports arrive in your dashboard. With the enforcement add-on, I act on them for you.
Proof, not promises
Delivered a complex e-commerce platform 2 weeks ahead of schedule. Clean code, excellent communication, and zero post-launch bugs. Will hire again.
Parish doesn't just write code. He thinks about the user, the team, and the long-term maintainability. A rare combination of speed and quality.
SPF, DKIM and DMARC setup pricing
One fixed price, agreed before any work starts. Add only what you need.
SPF, DKIM and DMARC setup
8 things included, delivered in 2 business days
$290
Your fixed price
$290
Delivered in 2 business days after payment.
Order now- Passing, or a full refund. If SPF, DKIM and DMARC do not all pass on test emails to Gmail and Outlook, you get a full refund.
- No payment today. I confirm your brief, then send an invoice you pay by bank transfer in USD, EUR or GBP.
Need ongoing work instead of a one-off job? A monthly plan covers requests like this with no quotes.
The guide, 3 minute read. Updated .
On this page
Why are my emails going to spam?
The most common reason is not your wording. It is that the receiving server cannot prove the email really came from you. Gmail, Yahoo and Outlook check three DNS records on your domain, SPF, DKIM and DMARC. When they are missing, broken or do not line up, your email looks exactly like a phishing attempt using your name.
Since February 2024, Gmail and Yahoo require authentication from everyone who sends to their users, with stricter rules for bulk senders. Microsoft followed for Outlook.com in May 2025. Enforcement has tightened since, which is why email that used to arrive fine can start landing in spam or bouncing without anything changing on your side.
Other causes matter too: a poor sending reputation, high spam complaints, or links to flagged domains. But authentication comes first, because without it nothing else can be trusted.
SPF, DKIM and DMARC in plain English
| Record | The question it answers | Where it lives | Common mistake |
|---|---|---|---|
| SPF | Is this server allowed to send email for this domain? | A TXT record on your domain | Two SPF records, or more than 10 DNS lookups |
| DKIM | Was this email really signed by the domain, and unchanged on the way? | A TXT or CNAME record per sending service | Never switched on in the mailbox admin |
| DMARC | Do SPF or DKIM match the visible From address, and what should happen if not? | A TXT record at _dmarc | Missing, or jumping straight to p=reject |
; SPF: one record listing every service that sends as you
example.com. TXT "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all"
; DKIM: a public key per sending service (the selector name varies)
google._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."
; DMARC: start by monitoring, then enforce
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"Gmail, Yahoo and Outlook sender requirements
Everyone who sends to Gmail or Yahoo
- Authenticate with SPF or DKIM.
- Send from servers with valid forward and reverse DNS, over TLS.
- Keep reported spam below 0.3% (ideally below 0.1%).
Bulk senders (about 5,000 or more emails a day)
- Authenticate with both SPF and DKIM.
- Publish a DMARC record (p=none is the minimum) and align it with your From domain.
- Offer one-click unsubscribe on marketing email, and honour it within two days.
- For Outlook.com, the same SPF, DKIM and DMARC rules apply above 5,000 emails a day since May 2025.
How to set up DMARC without breaking your email
- 1Monitor. Publish
p=nonewith a reporting address. Nothing is blocked; you just start receiving daily reports from Gmail, Yahoo, Microsoft and others. - 2Find every sender. Reports show every server sending as your domain. Legitimate tools you forgot, like an old CRM or invoicing app, get SPF and DKIM set up.
- 3Quarantine. Once real email passes, move to
p=quarantine, so anything failing goes to spam instead of the inbox. - 4Reject. Finally,
p=rejecttells receivers to refuse spoofed email outright. Your domain can no longer be used to phish your customers.
Do not jump straight to reject
Publishing p=reject before every sender passes is the fastest way to lose real email, like password resets from your app or invoices from your accounting tool. Two to four weeks of monitoring first is the safe path.
Common SPF and DKIM mistakes
- Two SPF records. A domain may have only one. Two is an automatic failure, so every sender must be merged into a single record.
- More than 10 lookups. Every
includecosts DNS lookups, and nested includes add up. Past 10, SPF fails with a permanent error. - DKIM never switched on. Google Workspace and Microsoft 365 both need DKIM enabled in the admin console, not just a DNS record.
- Forgotten senders. Your newsletter tool, CRM, help desk and website forms each send as your domain and each need authentication.
- Short keys. 1024-bit DKIM keys still work, but 2048-bit is the current recommendation wherever the provider supports it.
Google Workspace and Microsoft 365 specifics
Google Workspace: SPF uses include:_spf.google.com. DKIM is generated in the Admin console under Gmail’s “Authenticate email” setting, published as a TXT record at google._domainkey, and then switched on with “Start authentication”. That last click is the step most often missed.
Microsoft 365: SPF uses include:spf.protection.outlook.com. DKIM is enabled in the Microsoft Defender portal and needs two CNAME records, selector1 and selector2, which Microsoft rotates for you once they are in place.
BIMI: your logo next to your emails
BIMI shows your logo beside your emails in supporting inboxes like Gmail, Yahoo and Apple Mail. It only works once DMARC is at enforcement (quarantine or reject), and Gmail also requires a paid mark certificate. It is a nice finishing touch after the fundamentals, and an add-on here.
SPF, DKIM and DMARC setup FAQ
Often ordered with
Add Stripe Checkout to your website
Cards, Apple Pay and Google Pay on your site, with verified webhooks so every paid order is recorded and fulfilled.
Works with Next.js, React, Node.js and 4 more
$690
Fixed price, 3 business days
Pass Core Web Vitals: fix LCP, INP and CLS
Slow, jumpy pages fixed in your code for up to three page templates, with a before and after report and Search Console validation.
Works with Next.js, React, WordPress and 4 more
$890
Fixed price, 5 business days
Add an AI chatbot trained on your content
A branded chat widget that answers from your own pages and documents, cites its sources, and hands off to you when it is unsure.
Works with Any website, WordPress, Webflow and 6 more
$1,490
Fixed price, 7 business days
Planning something bigger? Technical SEO are quoted as custom builds.
Ready when you are.
SPF, DKIM and DMARC setup for a fixed $290. Ordering takes two minutes, and there is no payment until I have confirmed your brief.
You work with me directly, on a monthly plan or a fixed-price project. No agency layer, one person accountable for the build.