How to set up SPF, DKIM, and DMARC for your sending domain

SPF, DKIM, and DMARC are the three DNS-based authentication standards inbox providers use to decide whether to trust mail claiming to be from your domain. Misconfigured authentication is the most common deliverability failure for new senders. This guide configures all three correctly the first time.

1. 1

   Find your sending platform's authentication settings

   In Webanto, go to Settings > Sending domains > Add domain. Enter your domain. The platform will display the exact SPF and DKIM records you need to add — copy them.

2. 2

   Add the SPF record

   In your DNS, create a TXT record on the root domain (@) with the value supplied. A typical SPF for Webanto looks like 'v=spf1 include:_spf.webanto.com ~all'. Only one SPF record per domain — if you already have one, merge them, don't add a second.

3. 3

   Add the DKIM record

   Create the DKIM TXT record at the selector subdomain supplied (typically something like 'webanto._domainkey'). The value is a public key string — copy it exactly, no line breaks.

4. 4

   Wait for DNS propagation

   DNS changes typically propagate in 5-30 minutes. Use 'dig txt yourdomain.com' or an online DNS lookup tool to verify the records are visible publicly before continuing.

5. 5

   Verify SPF and DKIM in your sending platform

   Back in Webanto, click 'Verify' on the sending domain. Both SPF and DKIM should show green checkmarks. If either fails, double-check the DNS record matches what was supplied (a single typo will fail verification).

6. 6

   Add a permissive DMARC policy first

   Create a TXT record at _dmarc.yourdomain.com with value 'v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com'. The 'p=none' starts in report-only mode so you can monitor without blocking any mail.

7. 7

   Monitor DMARC reports for 2-4 weeks

   DMARC reports tell you which sources are sending mail as your domain. Look for unexpected legitimate senders (your CRM, your invoicing tool, your support desk) and configure SPF or DKIM for them too.

8. 8

   Tighten DMARC to 'quarantine' then 'reject'

   Once all legitimate senders are accounted for and DMARC reports show 100 percent alignment, change 'p=none' to 'p=quarantine' (sends spoofed mail to spam) for 2 weeks, then 'p=reject' (blocks it). This is the goal state.