SPF, DKIM and DMARC step by step – keeping your mail out of the spam folder

Three DNS records decide whether Gmail and Outlook trust your domain. Here is what each one does and how to set them correctly.

Since 2024 Gmail and Yahoo require senders to authenticate their domain. Without correct SPF, DKIM and DMARC records, mail from your domain may land in spam or not arrive at all. The good news: it is three DNS records, set once.

SPF – who may send on behalf of the domain

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send mail from @yourdomain.com addresses. Example:

yourdomain.com.  IN TXT  "v=spf1 include:_spf.hosteam.pl -all"
  • include: points at your hosting provider’s mail servers,
  • -all tells the receiver to reject anything outside that list.

The most common mistake is publishing several SPF records – a domain may have only one. If you also use an external newsletter tool, add its include: to the same record.

DKIM – a cryptographic signature on every message

DKIM (DomainKeys Identified Mail) adds a signature to each message that the receiver verifies against a public key published in DNS. It proves the message was not altered in transit and that the sender controls the domain.

In the Hosteam panel DKIM is one click in the mail domain settings – the panel generates the key and adds the default._domainkey record when the zone is hosted with us. If your DNS lives elsewhere, copy the shown TXT record into your zone.

DMARC – what to do when things do not add up

DMARC ties the two together and tells receivers how to treat messages that fail verification, and where to send reports:

_dmarc.yourdomain.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Start with p=none (reports only), review the reports after a week, then move to quarantine and eventually reject.

How to check it works

  1. Send a message to your own Gmail account.
  2. Open “Show original” – the header shows SPF: PASS, DKIM: PASS, DMARC: PASS.
  3. The Mail → Domain tab in the Hosteam panel shows the status of all three records and warns when one disappears.

If any of them shows FAIL, it is usually a typo or a second SPF record. Write to us – we will check the zone with you.

Looking for fast hosting?

NVMe servers in a Polish data centre, 24/7 support and our own panel.

See hosting plans