Updated October 2026. SPF, DKIM and DMARC are three DNS records that prove email from your domain really comes from you. Without them, Gmail and Outlook are more likely to send your invoices and quotes to spam, and anyone can send mail pretending to be your company. Since 2024, Google and Yahoo require them for bulk senders.
Who this guide is for: Any Kenyan business sending invoices, quotes, newsletters or website form emails from its own domain.
Contents
SPF: who may send
A TXT record listing the servers allowed to send for your domain, for example v=spf1 mx include:_spf.google.com ~all. You can only have one SPF record per domain; combine services into it.
DKIM: a signature on every message
Your mail server signs each email with a private key. The matching public key sits in DNS as a TXT record under a selector such as default._domainkey. Receivers check the signature to confirm the message was not altered.
DMARC: what to do when checks fail
A TXT record at _dmarc.yourdomain, for example v=DMARC1; p=none; rua=mailto:reports@yourdomain. Start with p=none to collect reports, then move to quarantine and finally reject once all your legitimate senders pass.
Setup checklist
- List every service that sends mail as your domain: your mailbox provider, website forms, newsletter tool, invoicing system.
- Add all of them to one SPF record.
- Turn on DKIM in each service and publish its key.
- Publish DMARC at p=none and read the reports for two weeks.
- Tighten the policy.
How to test
Send a message to a Gmail address and choose “Show original”: SPF, DKIM and DMARC should each say PASS. Free tools such as MXToolbox check the records too.
Forwarding
Forwarding mail to Gmail can break SPF. A server using SRS (Sender Rewriting Scheme) rewrites the sender so forwarded mail still passes.
Key terms in SPF, DKIM and DMARC
- SPF
- Sender Policy Framework: lists servers allowed to send for your domain.
- DKIM
- DomainKeys Identified Mail: a cryptographic signature on each message.
- DMARC
- Tells receivers what to do when SPF or DKIM fail, and sends reports.
- MX record
- Tells the internet which server receives your domain's email.
- SRS
- Sender Rewriting Scheme: keeps forwarded mail passing SPF.
- Alignment
- DMARC's check that the visible From domain matches the authenticated domain.
Questions to ask before you hire help with SPF, DKIM and DMARC
- Which services send mail as our domain?
- Who will read DMARC reports?
- When will the policy move to quarantine or reject?
- How will forwarding be handled?
- How will we test after changes?
SPF, DKIM and DMARC: mistakes to avoid
- Two SPF records instead of one.
- Forgetting website forms or newsletter tools in SPF.
- Jumping straight to p=reject.
- Never reading DMARC reports.
- Leaving DKIM switched off in a sending service.
SPF, DKIM and DMARC: how to measure success
Read DMARC aggregate reports for the share of messages passing, check Gmail's Show original on test emails, and watch bounce and spam complaint rates in your sending tools.
What is different in Kenya
Many .co.ke domains are registered through local registrars whose DNS panels differ; the records are the same but the screens vary. Businesses that send M-Pesa receipts, invoices or school fee statements by email are hit hardest when mail goes to spam, so authenticate before any bulk send.
SPF, DKIM and DMARC: costs to plan for
SPF, DKIM and DMARC records are free to add. Costs come from your mailbox provider and, optionally, a DMARC reporting service that turns raw reports into readable dashboards.
SPF, DKIM and DMARC: a 30-day starter plan
- Week 1: list every sending service and add one combined SPF record.
- Week 2: enable DKIM in each service and publish the keys.
- Week 3: publish DMARC at p=none and collect reports.
- Week 4: fix failing senders and plan the move to quarantine.
SPF, DKIM and DMARC: summary
This guide to SPF, DKIM and DMARC covered: SPF: who may send; DKIM: a signature on every message; DMARC: what to do when checks fail; Setup checklist; How to test; Forwarding. Work through them in order, measure as you go, and keep every fact tied to an official or first-hand source.
Sources
- Google: email sender guidelines (accessed October 2026)
- DMARC.org (accessed October 2026)
Need this done for you? See our managed hosting.
SPF, DKIM and DMARC: frequently asked questions
Do I need all three records?
Yes. SPF and DKIM prove authenticity; DMARC tells receivers what to do and sends you reports.
Will DMARC block my own email?
Only at quarantine or reject, and only if a sender is not set up correctly. That is why you start at p=none.
Where do I add these records?
In the DNS settings at your domain registrar or DNS host, such as your .co.ke registrar's control panel.
Why do my emails go to spam even with SPF?
SPF alone is not enough; DKIM, DMARC, sending reputation and content all play a part.
Can I have two SPF records?
No. Two SPF records cause a failure; merge them into one.
Does Google Workspace set these up automatically?
It provides the values, but you must add the records in your DNS.
What does ~all mean in SPF?
A soft fail: mail from unlisted servers is treated with suspicion rather than rejected outright.
Who sends DMARC reports?
Large mailbox providers send aggregate reports to the address in your rua tag.
Do I need a dedicated IP?
Not for most businesses; a reputable mail provider's shared infrastructure is fine.
Related
Want help with this?
Tell us about your business in a few lines. We reply within one working day.
Prefer WhatsApp? +254 790 939 404 · We reply within one working day.