Key facts
- £45 an hour + VAT for record set-up and changes
- One SPF TXT record per domain, starting v=spf1
- SPF limited to 10 DNS lookups
- DKIM selector for each sending service
- DMARC staged: p=none, then quarantine, then reject
- Google, Yahoo and Microsoft expect authentication from bulk senders
- MTA-STS and BIMI added on request
SPF: one record, ten lookups
SPF lists the servers allowed to send mail for your domain. It is a single TXT record beginning v=spf1. The rules are strict:
- Only one SPF record. Two records starting
v=spf1cause a permanent error, so SPF fails for everything. Adding a new service means editing the existing record, not adding another. - No more than 10 DNS lookups. Each
include,a,mx,ptr,existsandredirectcounts, including lookups inside the services you include. Too many tools and SPF breaks. - Ending:
~allis a soft fail,-alla hard fail. - Length: TXT strings over 255 characters must be split.
Microsoft 365 uses include:spf.protection.outlook.com; Google Workspace uses include:_spf.google.com.
DKIM: a selector for every sender
DKIM signs each message with a private key. The matching public key sits in DNS under a selector, so receivers can check the message was not changed. Every service that sends as your domain needs its own selector.
- Microsoft 365: two CNAME records,
selector1._domainkeyandselector2._domainkey, with values taken from the Microsoft portal. - Google Workspace: a key generated in the Admin console, published as a TXT record at
google._domainkey. 2048-bit is recommended. - Newsletter and CRM tools: their own selectors, usually CNAMEs they supply.
DMARC: from watching to enforcing
DMARC is a TXT record at _dmarc.yourdomain. It tells receivers what to do with mail that fails, and where to send reports. A message passes DMARC when SPF or DKIM passes and lines up with the domain in the From address.
| Stage | Policy | What happens |
|---|---|---|
| 1 | p=none | Nothing blocked; reports show who sends as you |
| 2 | p=quarantine | Failing mail goes to spam |
| 3 | p=reject | Failing mail is refused |
We move up a stage only when the reports show every real sender passing.
Bulk sender rules, MTA-STS and BIMI
Since February 2024, Google and Yahoo expect all senders to have SPF or DKIM, and bulk senders to have SPF, DKIM and DMARC (at least p=none) with alignment. Microsoft has applied similar requirements to domains sending over 5,000 messages a day to Outlook.com, Hotmail and Live addresses since May 2025. Enforcement detail changes, so we check the current rules for your situation.
Two optional extras: MTA-STS (a TXT record at _mta-sts plus a policy file on a web server) asks senders to use verified encryption, and BIMI can show your logo in supporting inboxes once DMARC is at quarantine or reject.
Record mistakes we often fix
- A second SPF record added by a new tool's set-up wizard instead of being merged into the first.
- An SPF record still including a service you stopped using years ago, wasting lookups.
- DKIM keys published under the wrong name, for example with the domain typed in full in a DNS panel that adds it automatically.
- A DMARC record placed at the root of the domain instead of at
_dmarc. - A DMARC policy moved straight to
p=rejectbefore every sender was passing. - A 2048-bit DKIM key pasted as one string over 255 characters without being split.
How dijitul helps
We audit what is published, list every service that sends as you, fix or merge the records, then guide DMARC through its stages. The DNS work is £45 an hour + VAT. For the full walk-through, read our guide to setting up SPF, DKIM and DMARC or what DMARC is.
If mail is still landing in spam once the records pass, our sister team at dijitulsupport handles wider deliverability problems. To start with the records, contact us.
How it works and what it costs
Domains are priced live in the client portal. DNS management and 10 mailboxes are included with dijihost Complete Hosting at £1 a day + VAT. On their own, DNS and email set-up is £45 an hour + VAT or a fixed quote.
Tell us what you have
Your domains, who they are registered with, where your DNS and email live today, and what you want to change.
Plan the change
We list every DNS record and mailbox first, so nothing is forgotten, and agree a time to switch.
Make the switch
Transfers, nameserver changes, DNS records and mailbox moves, done carefully with low TTLs and a rollback plan.
Check it works
We test the website, email delivery, SPF, DKIM and DMARC from the outside before calling it done.
Look after it
Renewals, records and email stay looked after, and you can call a person when something changes.
Frequently asked questions
Can I have two SPF records?
No. A domain must have only one TXT record starting v=spf1. Two records cause a permanent error and SPF fails for all your mail. When you add a new sending service, merge its include into the existing record instead. dijitul checks for duplicate SPF records on every audit.
What is the SPF 10 lookup limit?
SPF evaluation may trigger no more than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including lookups nested inside included records. Exceed it and SPF returns an error. Removing unused services or replacing includes with fixed addresses brings the count down.
What is a DKIM selector?
A selector is the label that tells receivers where to find the public key for a DKIM signature, published at selector._domainkey.yourdomain. Microsoft 365 uses selector1 and selector2, Google Workspace defaults to google, and each other sending service has its own.
Should I set DMARC straight to reject?
No. Start with p=none and read the reports to find every service sending as your domain. Fix their SPF and DKIM, then move to p=quarantine, and only then to p=reject. Jumping straight to reject risks blocking genuine invoices or newsletters.
Do small businesses need DMARC?
Google and Yahoo require DMARC from bulk senders, and Microsoft has similar rules for high-volume senders to its consumer addresses. Smaller senders are not always required to have it, but a DMARC record makes it harder for others to spoof your domain and gives you useful reports.
What does BIMI need?
BIMI needs DMARC at quarantine or reject, a logo in the SVG Tiny PS format, and for Gmail a VMC or CMC certificate. It is optional and mainly suits brands that already have strong authentication in place. dijitul can publish the record once the requirements are met.
Related
Get domains, DNS and email sorted
Set up properly, records checked, and real people to call. DNS and email are included with dijihost hosting.