Set up SPF, DKIM, and DMARC for your domain

SPF, DKIM and DMARC are three DNS records that prove your mail really comes from your domain. Publish all three at your DNS host before you send cold email, then confirm them in Fuzegenai from the DNS column on the Email Accounts page.

What each record does

• SPF is a TXT record on your domain listing the servers allowed to send mail for it. The standard is RFC 7208.
• DKIM signs every outgoing message. The key pair is generated in your email provider's admin console; you publish the public half in DNS. The standard is RFC 6376.
• DMARC is a TXT record at _dmarc.yourdomain.com. It tells inbox providers what to do when SPF and DKIM do not line up with your From address, and where to send reports. The standard is RFC 7489.

Gmail and Yahoo require these records from bulk senders; see Google's email sender guidelines and Yahoo's sender best practices.

Google Workspace

1. Publish a TXT record on the root of your domain: v=spf1 include:_spf.google.com ~all
2. In the Google Admin console, open Apps, then Google Workspace, then Gmail, then Authenticate email. Generate the DKIM key and publish the TXT record it gives you, usually at the host google._domainkey. Come back and start authentication.
3. Publish a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Microsoft 365

1. Publish a TXT record on the root of your domain: v=spf1 include:spf.protection.outlook.com -all
2. In the Microsoft admin centre, enable DKIM for the domain, publish the two CNAME records it gives you at selector1._domainkey and selector2._domainkey, then switch signing on.
3. Publish the same DMARC record shown above.

Keep one SPF record and one DMARC record per domain. A second record of either kind is invalid and both can be ignored. To see what your domain publishes before you connect a mailbox, run the free domain checker.

Start DMARC at p=none

p=none monitors without affecting delivery, so you can see failures before they cost you mail. Read the reports arriving at your rua address for a couple of weeks. Once your own mail is passing consistently, tighten to p=quarantine, then p=reject.

How the checks appear in Fuzegenai

1. Open Email Accounts from the sidebar.
2. The DNS column starts hidden. Turn it on from the Columns menu above the table.
3. Click the DNS cell for a mailbox to open the DNS health dialog.

The dialog runs live DNS lookups for SPF, DKIM, DMARC and MX, and shows the record it found with a copy button. Each check reads Pass, Warning, Fail or Unknown. After you change anything at your DNS host, use Recheck DNS — from the dialog or the row menu. DNS changes take time to propagate, so give it a while before you re-check.

Two results surprise people:

• A DMARC record at p=none reads Warning, not Pass. That is a nudge to tighten the policy, not a broken record.
• DKIM reads Warning when no key is found at one of the common selector names. If your provider uses an unusual selector, DKIM can be signing correctly and still read Warning.

For a per-domain view, the Domain DNS Health card sits under Global Analytics, on the Health Metrics tab.

Fuzegenai reads your records; it does not create or host them. Every change is made at your DNS provider.

Once authentication is in place, move on to What is domain warmup and how long does it take?. If a check stays red after propagation, send the domain name to priority@fuzegenai.com.