SPF + DKIM + DMARC: Complete Email Authentication (Guide)

Introduction

SPF, DKIM and DMARC are the three technologies that prove to Gmail, Outlook and other providers that your emails are legitimate. Configuring all three is the way to guarantee maximum deliverability and protect your domain from spoofing.

In this article you’ll see how to configure all three, in order, safely.

Why you need all three

Technology	What it does	Without it
SPF	Lists authorized servers	Your emails go to spam
DKIM	Signs emails	Someone can spoof your domain
DMARC	Defines what to do if SPF or DKIM fail	You have no control or reports

The three are complementary. Configuring only one or two is better than nothing, but isn’t complete protection.

Configuration order

Configure them in this order:

1. SPF (the most basic)
2. DKIM (adds the signature)
3. DMARC (unites both and protects)

Don’t configure DMARC without having SPF and DKIM. If you do, your own emails can go to spam.

Step 1: Configure SPF

SPF is a TXT record in DNS listing authorized servers.

1. Log in to cPanel → Zone Editor.
2. Add a TXT record:
   • Name: yourdomain.com.
   • Value: v=spf1 include:_spf.mihosting.com ~all
3. Save.

You have the complete SPF guide in our knowledge base.

Step 2: Configure DKIM

DKIM signs your emails with a cryptographic key.

1. Log in to cPanel → Email Deliverability or Authentication.
2. Enable DKIM.
3. cPanel adds the DNS record automatically (or shows it for you to add).

You have the complete DKIM guide in our knowledge base.

Step 3: Configure DMARC (start with none)

DMARC defines what to do with emails that don’t pass SPF or DKIM.

1. Log in to cPanel → Zone Editor.
2. Add a TXT record:
   • Name: _dmarc.yourdomain.com.
   • Value: v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com
3. Save.

Start with p=none (blocks nothing, only receives reports). After 2-4 weeks, upgrade to quarantine and then reject.

Step 4: Verify everything works

1. Send an email to a Gmail address.
2. Open the email → three dots → Show original.
3. Look for Authentication-results:.
4. It should say:
   • spf=pass
   • dkim=pass
   • dmarc=pass

If all three say pass, your authentication is perfect.

Step 5: Review DMARC reports

DMARC sends you reports to the address you set. Review them to see:

• Which services send email with your domain.
• If all pass SPF and DKIM.
• If there are spoofing attempts.

Use tools like dmarcian to read reports more visually.

Complete authentication checklist

• SPF configured and verified.
• DKIM enabled and verified.
• DMARC configured with p=none.
• DMARC reports reviewed for 2-4 weeks.
• All sending services pass SPF and DKIM.
• DMARC upgraded to quarantine or reject.
• Gmail test email with pass in all three.

Useful tips

• Configure all three in order. SPF → DKIM → DMARC.
• Don’t skip steps. If you jump to DMARC reject without verifying, you lose emails.
• Include all your sending services. Hosting, Mailchimp, SendGrid, Google Workspace, etc.
• Review every 6 months. If you add a new service, update SPF.
• Use mxtoolbox to verify. It’s free and shows the status of all three.

Frequently asked questions

How long does it take to take effect?

DNS changes take between minutes and 48 hours to propagate.

Are all three free?

Yes, all three are free DNS records.

Does my miHosting hosting have them?

SPF and DKIM are enabled from cPanel. DMARC you configure in DNS. If you need help, open a ticket.

Can I configure all three on the same day?

Yes. SPF and DKIM are immediate. DMARC starts with none (doesn’t affect email) and you upgrade after a few weeks.

If I configure all three, will my emails never go to spam?

It doesn’t guarantee 100%, but drastically reduces the probability. Deliverability also depends on content and reputation.

All three together: maximum deliverability and protection

SPF, DKIM and DMARC are the three keys of email authentication. Configured together, in order, they guarantee maximum deliverability and protect your domain from spoofing. It’s free, fast and essential.

If you need help configuring all three on your miHosting domain, open a ticket from your client panel.