Email security fix guides

SPF: list who may send email as your domain

• Add one TXT record at your domain's root (the host is usually @) that starts with v=spf1.
• Microsoft 365: v=spf1 include:spf.protection.outlook.com -all. Google Workspace: v=spf1 include:_spf.google.com ~all.
• If other services send as you (newsletters, client portals, practice or tax software), add their include: to the same record. A domain may have only one SPF record, and at most 10 DNS lookups.

DKIM: sign every message

• DKIM is switched on inside your email service, which then gives you one or two DNS records to add.
• After adding them, turn DKIM on (or "Start authentication") in the email service and send a new test.

DMARC: tell receivers what to do with fakes

• Add a TXT record with the host _dmarc. Start with v=DMARC1; p=none; rua=mailto:[email protected] to receive reports.
• After a few weeks of clean reports, change p=none to p=quarantine, and later to p=reject.
• Set up SPF and DKIM first, and make sure every service that sends as you passes, or its mail may be rejected.

No mail servers found

• Your domain has no MX records, so it cannot receive email, and many receivers distrust mail from it. Ask whoever set up your email which MX records to add.

Microsoft 365

• Add the SPF TXT record at your DNS host, turn on DKIM for your domain in the Microsoft Defender portal and publish its two CNAME records, then add DMARC.

Microsoft: Email authentication overview ↗ · Microsoft: Set up SPF ↗ · Microsoft: Set up DKIM ↗ · Microsoft: Set up DMARC ↗

Google Workspace

• Add the SPF TXT record, generate a DKIM key in the Google Admin console and add it to DNS, click Start authentication, then add DMARC.

Google: Set up SPF ↗ · Google: Set up DKIM ↗ · Google: Set up DMARC ↗

GoDaddy (email or DNS at GoDaddy)

• In your GoDaddy account, open the domain's DNS page, choose Add New Record and pick TXT. Use @ for SPF and _dmarc for DMARC.
• GoDaddy's own email (including Microsoft 365 from GoDaddy) uses its own SPF value; follow GoDaddy's article for your plan.

GoDaddy: Add a TXT record ↗ · GoDaddy: Add an SPF record ↗ · GoDaddy: Set up SPF, DKIM or DMARC for hosting email ↗ · GoDaddy: DMARC for Microsoft 365 ↗

Cloudflare (DNS at Cloudflare)

• In the Cloudflare dashboard, open your domain, go to DNS > Records and add TXT records for SPF (@) and DMARC (_dmarc), plus the DKIM records your email service gives you. Leave DKIM CNAMEs "DNS only" (grey cloud).

Cloudflare: Email DNS records ↗

Other email or DNS providers

• Records are added wherever your domain's DNS is managed: often the registrar where you bought the domain, or your web host. Search their help center for "add TXT record", and your email provider's help for "SPF", "DKIM" and "DMARC".
• Not sure who manages it? Your web or IT provider can tell you.