SPF, DKIM and DMARC: A Plain-English Setup Guide

Picture the scene. You run a small UK business — maybe a boutique in Bristol or a consultancy in Manchester — and you’ve spent weeks building a newsletter list. You hit send on your latest campaign, then wait for the replies and the clicks. Nothing. A quick check of your own inbox shows the email went straight to spam. Worse, a customer emails to say your last three newsletters never arrived at all. That sinking feeling is usually the moment a business owner first hears the phrase “email authentication” — and starts searching for SPF, DKIM and DMARC.

We’ve helped plenty of UK teams through this exact situation, and the good news is that it’s fixable. This guide explains all three records in plain English, why they matter for deliverability and UK GDPR, and how to set them up step by step.

Why Email Authentication Matters for UK Businesses

Authentication is how mailbox providers verify that an email genuinely came from your domain. Without it, anyone can pretend to send as your brand, and providers have no reliable way to tell your legitimate newsletter apart from a phishing attempt. In 2024, Google and Yahoo tightened their bulk sender requirements, and Microsoft has followed suit with Outlook — all three now lean heavily on authentication signals when deciding whether to deliver, filter or reject a message.

The deliverability problem: spam filters and blocked emails

Gmail and Outlook use authentication signals in spam filtering every day. An unsigned email from a domain with no SPF record is far more likely to be quarantined, throttled or silently dropped. For a business sending a weekly newsletter, that means open rates collapse and revenue quietly leaks away. Authentication won’t guarantee inbox placement on its own — content and engagement still matter — but without it, you’re starting from a losing position.

UK GDPR and email security: what the ICO expects

UK GDPR requires you to process personal data securely, and an email list is personal data. Article 32 specifically calls for appropriate technical measures to protect that data. The Information Commissioner’s Office (ICO) is the UK regulator for UK GDPR, and it expects organisations to be able to demonstrate the security measures they’ve put in place. Authentication records are part of that picture: they help prevent spoofing of your domain, which protects both your customers and your reputation.

SPF Explained: The Sender Policy Framework

SPF is a DNS TXT record that lists the servers authorised to send email on behalf of your domain. When a receiving server gets a message claiming to be from yourdomain.co.uk, it checks the SPF record and confirms whether the sending IP is on the approved list. If it isn’t, SPF fails.

If you use a UK ESP such as Mailchimp or Campaign Monitor, you’ll need to add their sending infrastructure to your SPF record — both providers require SPF and DKIM setup before you can send from your own domain. Other common senders include Google Workspace, Microsoft 365, and any transactional email service you use for order confirmations.

What an SPF record looks like

A typical record might look like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net include:cmail1.com ~all

• v=spf1 — identifies this as an SPF record.
• include: — pulls in the authorised sending servers for each provider.
• ~all — a “soft fail” for anything not listed, which tells receivers to be suspicious but not necessarily reject.

Common SPF mistakes and how to avoid them

The biggest trap is the 10-DNS-lookup limit. Each include, a, mx, ptr or exists mechanism counts as one DNS lookup, and SPF permits a maximum of ten. Exceed it and the record fails with a permanent error — which is worse than having no SPF at all. Other frequent errors include publishing multiple SPF records on the same domain (only one is allowed), forgetting to remove an old ESP after switching providers, and using -all before you’ve confirmed every legitimate sender is included.

DKIM Explained: DomainKeys Identified Mail

DKIM adds a cryptographic signature to the headers of every email you send. The receiving server looks up a public key published in your DNS and uses it to verify the signature. If the message was altered in transit, the signature won’t match — a strong signal that something is wrong.

Gmail and Outlook both factor DKIM results into their spam scoring. A valid signature tied to your own domain (rather than a shared ESP domain) also means your brand survives in the “via” line and builds domain reputation over time.

How DKIM signing works in practice

In most ESPs, you enable DKIM with a couple of clicks. The platform generates a key pair, gives you a TXT record to publish in your DNS, and then signs every outgoing message automatically. Mailchimp and Campaign Monitor both walk you through this in their domain authentication wizards. Once the record propagates — usually within an hour, though it can take up to 48 — you can verify the signature is valid.

Key length and rotation best practice

Use 2048-bit keys rather than 1024-bit; the shorter length is increasingly treated as weak. Rotate your DKIM keys at least annually, and immediately if you suspect a compromise or change ESP. Keep a record of when each key was generated so you don’t lose track.

DMARC Explained: Domain-based Message Authentication

DMARC sits on top of SPF and DKIM. It tells receiving servers what to do when a message fails both checks, and it sends you reports so you can see who’s sending as your domain. Without DMARC, a failed SPF or DKIM check is just a signal; with DMARC, you set the policy.

DMARC policies: none, quarantine and reject

• p=none — monitor only. Messages are delivered as normal, and you receive reports. This is where everyone should start.
• p=quarantine — failing messages go to spam. Use this once you’re confident your legitimate senders all pass.
• p=reject — failing messages are blocked outright. This is the end goal for a fully authenticated domain.

You also specify reporting addresses: rua for aggregate reports (daily summaries) and ruf for forensic reports (individual failure details, though many providers no longer send these for privacy reasons).

Reading DMARC reports without the headache

Raw aggregate reports arrive as XML files and are genuinely unreadable at scale. Services like dmarcian, Postmark’s DMARC Digests, and Valimail parse them into plain dashboards showing which IPs are sending as your domain and whether they pass. If you spot unfamiliar senders, that’s either a legitimate service you forgot to authenticate or someone spoofing you — both worth investigating.

How to Set Up SPF, DKIM and DMARC Step by Step

Here’s the order we recommend. Don’t rush it — a botched SPF record can break your entire domain’s email.

Step 1: Audit your existing DNS records

Log into your DNS provider and list every service that sends email as your domain: your ESP, Google Workspace or Microsoft 365, any CRM, invoicing tool, or transactional sender. Check whether an SPF record already exists and what it contains. Use MXToolbox’s SPF and DMARC lookup tools to see what the world currently sees.

Step 2: Publish SPF and enable DKIM

Build one SPF record that includes every legitimate sender, keeping an eye on the 10-lookup limit. Then enable DKIM in your ESP and publish the TXT record it provides. Verify both with MXToolbox before moving on.

Step 3: Roll out DMARC gradually

Start with v=DMARC1; p=none; rua=mailto:[email protected] and let it run for at least two to four weeks. Review the reports, fix any legitimate senders that are failing, then move to p=quarantine and finally p=reject.

Testing, Monitoring and Maintaining Your Setup

Authentication isn’t a set-and-forget task. New tools get added, ESPs change their sending infrastructure, and DNS records get edited during migrations. Build a habit of checking things regularly.

Tools for testing authentication

• MXToolbox — free SPF, DKIM and DMARC lookups.
• mail-tester.com — send a test email and get a spam score with authentication breakdown.
• dmarcian — DMARC report parsing and monitoring.
• Google Postmaster Tools — reputation and delivery data for Gmail.

Quarterly review checklist

1. Confirm SPF still lists every active sender and stays under ten lookups.
2. Check DKIM signatures are passing on a sample send.
3. Review DMARC aggregate reports for unknown senders.
4. Rotate DKIM keys if it’s been twelve months.
5. Document any changes for UK GDPR accountability — the ICO expects you to show what you did and when.

Authentication is an ongoing habit, not a one-off task. Start with SPF and DKIM today — they take an afternoon to get right — then roll out DMARC gradually over the following weeks. Your subscribers, your open rates and your compliance posture will all thank you.

FAQ

Do I need SPF, DKIM and DMARC, or can I just use one?

You need all three. SPF and DKIM are the underlying checks; DMARC is the policy that ties them together and gives you reporting. Using only one leaves gaps that spammers and spoofers can exploit, and Gmail and Outlook increasingly expect the full set from bulk senders.

Will setting up authentication guarantee my emails land in the inbox?

No — but it removes one of the biggest barriers. Inbox placement also depends on sender reputation, engagement, list hygiene and content. Think of authentication as the entry ticket, not the whole journey.

How long does it take for DNS changes to propagate?

Usually within an hour, but it can take up to 48 hours depending on your DNS provider’s TTL settings. We always recommend testing with MXToolbox before sending a live campaign.

Is DMARC a legal requirement under UK GDPR?

Not explicitly, but UK GDPR Article 32 requires appropriate technical measures to secure personal data. The ICO expects organisations to demonstrate accountability, and DMARC is a widely recognised control for protecting your domain and your subscribers from spoofing.

What happens if I exceed the 10-DNS-lookup limit in SPF?

The SPF check returns a permanent error (permerror), which means receivers can’t validate your sending IPs at all. That’s typically worse than having a soft fail. Audit your includes regularly and remove any senders you no longer use.