# SPF, DKIM and DMARC DNS Records

Source: https://dijituldns.co.uk/spf-dkim-dmarc-records/
Updated: 2026-10-18

> SPF, DKIM and DMARC are DNS records that prove your email really comes from you. dijitul writes and publishes them correctly: one SPF record within the 10-lookup limit, a DKIM key for every sending service, and a DMARC policy that moves from monitoring to enforcement. Record set-up and changes are £45 an hour + VAT.

Price: £45 an hour + VAT

## Key facts

- £45 an hour + VAT for record set-up and changes
- One SPF TXT record per domain, starting v=spf1
- SPF limited to 10 DNS lookups
- DKIM selector for each sending service
- DMARC staged: p=none, then quarantine, then reject
- Google, Yahoo and Microsoft expect authentication from bulk senders
- MTA-STS and BIMI added on request

## SPF: one record, ten lookups

SPF lists the servers allowed to send mail for your domain. It is a single TXT record beginning `v=spf1`. The rules are strict:

- **Only one SPF record.** Two records starting `v=spf1` cause a permanent error, so SPF fails for everything. Adding a new service means editing the existing record, not adding another.
- **No more than 10 DNS lookups.** Each `include`, `a`, `mx`, `ptr`, `exists` and `redirect` counts, including lookups inside the services you include. Too many tools and SPF breaks.
- **Ending:** `~all` is a soft fail, `-all` a hard fail.
- **Length:** TXT strings over 255 characters must be split.

Microsoft 365 uses `include:spf.protection.outlook.com`; Google Workspace uses `include:_spf.google.com`.

## DKIM: a selector for every sender

DKIM signs each message with a private key. The matching public key sits in DNS under a **selector**, so receivers can check the message was not changed. Every service that sends as your domain needs its own selector.

- **Microsoft 365:** two CNAME records, `selector1._domainkey` and `selector2._domainkey`, with values taken from the Microsoft portal.
- **Google Workspace:** a key generated in the Admin console, published as a TXT record at `google._domainkey`. 2048-bit is recommended.
- **Newsletter and CRM tools:** their own selectors, usually CNAMEs they supply.

## DMARC: from watching to enforcing

DMARC is a TXT record at `_dmarc.yourdomain`. It tells receivers what to do with mail that fails, and where to send reports. A message passes DMARC when SPF or DKIM passes **and** lines up with the domain in the From address.

| Stage | Policy | What happens |

| 1 | `p=none` | Nothing blocked; reports show who sends as you |
| 2 | `p=quarantine` | Failing mail goes to spam |
| 3 | `p=reject` | Failing mail is refused |

We move up a stage only when the reports show every real sender passing.

## Bulk sender rules, MTA-STS and BIMI

Since February 2024, Google and Yahoo expect all senders to have SPF or DKIM, and bulk senders to have SPF, DKIM and DMARC (at least `p=none`) with alignment. Microsoft has applied similar requirements to domains sending over 5,000 messages a day to Outlook.com, Hotmail and Live addresses since May 2025. Enforcement detail changes, so we check the current rules for your situation.

Two optional extras: **MTA-STS** (a TXT record at `_mta-sts` plus a policy file on a web server) asks senders to use verified encryption, and **BIMI** can show your logo in supporting inboxes once DMARC is at quarantine or reject.

## Record mistakes we often fix

- A second SPF record added by a new tool's set-up wizard instead of being merged into the first.
- An SPF record still including a service you stopped using years ago, wasting lookups.
- DKIM keys published under the wrong name, for example with the domain typed in full in a DNS panel that adds it automatically.
- A DMARC record placed at the root of the domain instead of at `_dmarc`.
- A DMARC policy moved straight to `p=reject` before every sender was passing.
- A 2048-bit DKIM key pasted as one string over 255 characters without being split.

## How dijitul helps

We audit what is published, list every service that sends as you, fix or merge the records, then guide DMARC through its stages. The DNS work is **£45 an hour + VAT**. For the full walk-through, read our guide to [setting up SPF, DKIM and DMARC](https://dijituldns.co.uk/guides/spf-dkim-dmarc-setup/) or [what DMARC is](https://dijituldns.co.uk/guides/what-is-dmarc/).

If mail is still landing in spam once the records pass, our sister team at [dijitulsupport](https://dijitulsupport.co.uk/) handles wider deliverability problems. To start with the records, [contact us](https://dijituldns.co.uk/contact/).

## FAQs

### Can I have two SPF records?

No. A domain must have only one TXT record starting v=spf1. Two records cause a permanent error and SPF fails for all your mail. When you add a new sending service, merge its include into the existing record instead. dijitul checks for duplicate SPF records on every audit.

### What is the SPF 10 lookup limit?

SPF evaluation may trigger no more than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including lookups nested inside included records. Exceed it and SPF returns an error. Removing unused services or replacing includes with fixed addresses brings the count down.

### What is a DKIM selector?

A selector is the label that tells receivers where to find the public key for a DKIM signature, published at selector._domainkey.yourdomain. Microsoft 365 uses selector1 and selector2, Google Workspace defaults to google, and each other sending service has its own.

### Should I set DMARC straight to reject?

No. Start with p=none and read the reports to find every service sending as your domain. Fix their SPF and DKIM, then move to p=quarantine, and only then to p=reject. Jumping straight to reject risks blocking genuine invoices or newsletters.

### Do small businesses need DMARC?

Google and Yahoo require DMARC from bulk senders, and Microsoft has similar rules for high-volume senders to its consumer addresses. Smaller senders are not always required to have it, but a DMARC record makes it harder for others to spoof your domain and gives you useful reports.

### What does BIMI need?

BIMI needs DMARC at quarantine or reject, a logo in the SVG Tiny PS format, and for Gmail a VMC or CMC certificate. It is optional and mainly suits brands that already have strong authentication in place. dijitul can publish the record once the requirements are met.

## Prices and contact

Domains are priced live in the client portal. DNS management and 10 mailboxes are included with dijihost Complete Hosting at £1 a day + VAT. On their own, DNS and email set-up is £45 an hour + VAT or a fixed quote. Domain search and registration: https://clients.dijitul.uk. Hosting: https://dijihost.co.uk/ (£1 a day + VAT). Contact: https://dijituldns.co.uk/contact/ · 01623 650333 · info@dijitul.uk