hollerpost Start free

Guides / SPF, DKIM and DMARC

Set up email on your new domain: SPF, DKIM and DMARC in plain English.

Last checked:

This guide is for small business owners who want their newsletters and customer emails to come from their own domain without landing in spam. It works whether you send with Hollerpost, Mailchimp, Klaviyo, or Google Workspace.

Forwarding, a real mailbox, and authenticated sending are three separate jobs.

When you buy a domain like sunnybakery.com, email does not work on it automatically. Three separate systems handle incoming mail, everyday replies, and bulk newsletters:

  • Email forwarding (incoming mail only). Most registrars let you forward hello@sunnybakery.com to your personal Gmail for free. Forwarding lets you read mail sent to your domain, but by itself it does not let you send authenticated mail from that address.
  • A real mailbox (everyday one-to-one replies). Services like Google Workspace or Fastmail give you an inbox that both receives and signs outgoing replies from your domain. We cover how to pick between free forwarding and Google Workspace in Your domain and inbox.
  • Authenticated bulk sending (SPF, DKIM, and DMARC). When you send a newsletter to hundreds of customers through Hollerpost, Mailchimp, or Klaviyo, Gmail and Yahoo check your domain’s public DNS records to verify you authorized that tool to send on your behalf.

What SPF, DKIM, and DMARC actually do.

Three records, three plain-English jobs.

  • SPF (Sender Policy Framework) is your guest list. It is a single TXT record on your domain that lists which servers are allowed to send mail for your domain.
  • DKIM (DomainKeys Identified Mail) is your tamper-proof signature. Your email tool gives you 1 to 3 CNAME (or TXT) records. Each email goes out with a cryptographic signature that receiving inboxes verify against those records.
  • DMARC (Domain-based Message Authentication, Reporting, and Conformance) is your instruction manual. It is a TXT record at _dmarc that tells Gmail and Yahoo what to do if an email fails SPF and DKIM, and where to send summary reports.

Part 1: Set up SPF, DKIM, and DMARC on any domain host.

These five steps work on every domain registrar and DNS host, whether you use Hollerpost or another email platform:

  1. Find where your domain’s nameservers point. Your DNS records always live where your nameservers point, even if you bought the domain somewhere else. If your domain uses Cloudflare nameservers, you edit DNS in Cloudflare, not at the registrar where you originally registered the name. [screenshot: Domain overview screen showing active nameservers pointing to the DNS host]
  2. Copy the DKIM records from your email tool. In Hollerpost, open Settings, then Send From Your Own Domain, and enter your domain to get three CNAME records. In Mailchimp or Klaviyo, open your domain authentication settings to get their CNAME rows. [screenshot: Hollerpost Settings > Send From Your Own Domain panel showing three copyable CNAME records]
  3. Add the DKIM CNAME records in your DNS table. Paste each CNAME Host and Value into your DNS provider. Most providers automatically append your domain name to the Host box, so enter only the prefix (such as abc123._domainkey, not abc123._domainkey.yourdomain.com). [screenshot: DNS table with three CNAME rows added for _domainkey]
  4. Add or update your single SPF TXT record. Check if your domain already has a TXT record starting with v=spf1. If you have one for Google Workspace or another inbox provider, keep or add its include: statement inside that same record instead of creating a second TXT record. Hollerpost signs your mail with DKIM on your own domain, which is what DMARC checks, so you don’t need to add Hollerpost to your SPF record. [screenshot: DNS table showing a single root TXT record starting with v=spf1]
  5. Add your starter DMARC TXT record at _dmarc. Create a TXT record with host _dmarc and the starter policy below. Beginning with p=none satisfies Gmail and Yahoo’s bulk-sender requirement right away without risking blocked mail while you verify everything works. [screenshot: DNS table showing a TXT record with Host _dmarc and Value v=DMARC1; p=none;]

Copy-paste starter records for DMARC and SPF.

Use this starter DMARC record if your domain does not have a _dmarc record yet. Replace yourdomain.com with your actual domain:

DMARC starter record (TXT) 
Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The rua=mailto: address must be a mailbox on your domain that you actually read, or you can remove the ; rua=mailto:dmarc@yourdomain.com part.

If you use Google Workspace for your inbox and need a clean SPF record on your root domain (@), copy this TXT record:

SPF record for Google Workspace (TXT) 
Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com ~all

Part 2: Exact clicks for the five most common DNS providers.

Pick the provider where your domain’s DNS is hosted to see the exact field labels and gotchas:

Cloudflare
  1. Open DNS Records. Sign in to the Cloudflare dashboard, pick your domain, and select DNS, then Records. [screenshot: Cloudflare left sidebar with DNS > Records selected]
  2. Start a new record. Select Add record and choose CNAME (for DKIM) or TXT (for SPF and DMARC) as the Type. [screenshot: Cloudflare Add record button and Type dropdown with CNAME or TXT selected]
  3. Paste Name and Target. Enter the Name and Target (or Content for TXT) from your email tool. [screenshot: Cloudflare Name and Target fields filled in with DKIM values]
  4. Turn off the orange proxy cloud on CNAMEs. Set Proxy status to DNS only (the gray cloud) and leave TTL on Auto. If a DKIM CNAME is left Proxied, email verification will fail. [screenshot: Cloudflare CNAME record editor showing Proxy status toggled off to DNS only gray cloud]
  5. Save and check CNAME flattening. Select Save. In Cloudflare DNS Settings, make sure “Flatten all CNAMEs” is turned off so external mail servers can read your DKIM CNAMEs. See Cloudflare’s DNS documentation. [screenshot: Cloudflare Save button and DNS Settings showing Flatten all CNAMEs turned off]
GoDaddy
  1. Open your Domain Portfolio. Sign in to GoDaddy and open your Domain Portfolio. [screenshot: GoDaddy Domain Portfolio list with domain row highlighted]
  2. Open DNS settings. Select your domain to open Domain Settings, then select the DNS tab. [screenshot: GoDaddy Domain Settings page with the DNS tab selected]
  3. Add a new record. Select Add New Record and choose CNAME or TXT from the Type menu. [screenshot: GoDaddy DNS Records table with Add New Record button highlighted]
  4. Enter the relative Name. Paste the Name without your domain on the end (GoDaddy appends your domain automatically) and paste the Value. Leave TTL at the default. [screenshot: GoDaddy record editor showing relative Name, Value, and default TTL]
  5. Save all records. Select Save (or Save All Records). If GoDaddy Domain Protection is active, complete the two-step verification prompt so your changes take effect. See GoDaddy’s CNAME guide. [screenshot: GoDaddy Save All Records button and verification confirmation]
Namecheap
  1. Open Domain List. Sign in to Namecheap and select Domain List from the left menu. [screenshot: Namecheap account sidebar with Domain List selected and Manage button next to the domain]
  2. Open Advanced DNS. Click Manage next to your domain and select the Advanced DNS tab. [screenshot: Namecheap domain management view with the Advanced DNS tab selected]
  3. Add a record row. In the Host Records section, click Add New Record and choose CNAME Record or TXT Record. [screenshot: Namecheap Host Records table with Add New Record button and type menu]
  4. Paste the relative Host. Enter only the prefix in the Host field (Namecheap adds your domain automatically; entering the full domain creates yourdomain.com.yourdomain.com) and paste the Value. [screenshot: Namecheap Host Records row showing relative Host and Value fields]
  5. Save changes. Click the green checkmark or Save All Changes button. Note that if Namecheap BasicDNS is set to Email Forwarding, switching mail settings can reset TXT records, so verify your rows after saving. See Namecheap’s DNS article. [screenshot: Namecheap Save All Changes button highlighted above Host Records]
Squarespace Domains (including former Google Domains)
  1. Open your domains dashboard. Sign in to Squarespace Domains and click the domain you send from. [screenshot: Squarespace Domains dashboard showing the domain list]
  2. Open DNS Settings. Click DNS in the left menu, then select DNS Settings. [screenshot: Squarespace Domains menu showing DNS > DNS Settings]
  3. Scroll to Custom Records. Scroll down to the Custom Records section, click Add record, and complete any 2FA verification prompt. [screenshot: Squarespace Custom Records section with Add record button highlighted]
  4. Paste Name and Data. Choose CNAME or TXT as the Type. Enter the relative prefix in Name (Squarespace appends your domain automatically) and paste the record target in Data without a trailing period. [screenshot: Squarespace Custom Records modal with Type, Host/Name, and Data fields]
  5. Save the record. Click Save and repeat for each remaining record. See Squarespace’s email DNS guide. [screenshot: Squarespace Custom Records table showing saved CNAME and TXT rows]
Porkbun
  1. Open Domain Management. Sign in to Porkbun and open Domain Management from the Account menu. [screenshot: Porkbun Account menu showing Domain Management]
  2. Open the DNS editor. Hover over your domain row and click the DNS button. [screenshot: Porkbun Domain Management row with the DNS button highlighted]
  3. Select the record type. Under Manage DNS Records, choose CNAME or TXT from the Type menu. [screenshot: Porkbun Manage DNS Records Type dropdown with CNAME or TXT selected]
  4. Enter Host and Answer. Paste the relative prefix into Host (Porkbun appends your domain name on its own) and paste the value into Answer (or Target). Leave TTL at the default. [screenshot: Porkbun Manage DNS Records form showing Type, Host, and Answer fields]
  5. Click Add. Click Add and repeat for each record. See Porkbun’s DNS knowledgebase article. [screenshot: Porkbun Current Records list showing the newly added DNS row]

If verification still fails, check these four culprits.

What usually trips up domain verification.

  • Two SPF records on the same domain. A domain can only have one v=spf1 TXT record at the root (@). If you have two separate SPF rows, receiving servers reject both. Merge every include: into a single TXT row.
  • Doubled domain names in the Host box. If a record still shows unverified after a little while, check whether your registrar turned abc._domainkey.yourdomain.com into abc._domainkey.yourdomain.com.yourdomain.com. Edit the Host field to keep only the part before your domain.
  • Editing DNS at the registrar when nameservers point elsewhere. If you bought the domain at GoDaddy but pointed nameservers to Cloudflare, Wix, or Shopify, GoDaddy’s DNS table is inactive. Add the records where the active nameservers live.
  • Want me to check it with you? Never email your registrar password to anyone. Every major DNS host has a role-based access invite (or we can do a quick screen share where you stay in control). Email support@hollerpost.com and I will look up your domain’s live records and tell you what is missing.

Want a real person to check your setup?

Hollerpost detects your DNS provider from your nameservers, gives you the exact field labels for your host, and checks verification automatically.

Try it free

Free includes 1,000 emails a month, no card. Paid plans from $8/mo.

Did this help you finish? Tell me in 10 seconds.