Email sender authentication (SPF, DKIM and DMARC)
Add SPF, DKIM and DMARC records to the domain of your mailbox before you send sequence emails. These records prove to the recipient’s email provider that your emails come from you. If your account has the sender authentication check, Vaam checks these records when you connect a mailbox. You can then see the result in your email settings. The person who manages your domain’s DNS, usually your IT administrator, makes these changes.
What SPF, DKIM and DMARC are
Section titled “What SPF, DKIM and DMARC are”Each record is a short text entry in the DNS settings of your domain:
- SPF (Sender Policy Framework) lists the services that can send email for your domain. For example, it tells providers that Google Workspace or Microsoft 365 sends your email.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The recipient’s provider uses a public key in your DNS to confirm that nobody changed the email on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) tells providers what to do with an email that fails SPF and DKIM. It can also send you reports about the email that uses your domain.
Why they matter
Section titled “Why they matter”Email providers use these records to decide if an email goes to the inbox, the spam folder, or nowhere. An email from a domain without them looks like it can come from anyone.
Since February 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders. Gmail also requires SPF or DKIM from all senders. See Google’s email sender guidelines for the full rules.
Missing records can cause these problems:
- More of your emails go to spam.
- Recipient servers reject your emails.
- Your email provider restricts your mailbox. Microsoft, for example, can reject sends with the error
550 5.1.8 Access denied, bad outbound sender.
If Vaam paused your mailbox, see Email sending paused.
Check your records
Section titled “Check your records”You can check your records in two ways.
In Vaam
Section titled “In Vaam”Open Settings > Outreach > Email accounts at app.vaam.io. Under the connected mailbox, the Sender authentication line shows three items: SPF, DKIM and DMARC.
Vaam checks your domain when you connect a Gmail, Google Workspace, Microsoft 365 or Outlook mailbox. When you open the settings page and the last check is more than 7 days old, Vaam checks again. To check again at any time, for example after you change a record, select Check again.
| Status | Meaning | Your action |
|---|---|---|
| Set up (green check mark) | The record exists and covers your email provider. For DMARC, Vaam also shows the policy, for example none. |
No action. |
| Needs attention (amber mark) | The record is missing. Or the record exists but does not cover your email provider. Or the record has a setup problem, for example two SPF records for one domain, or one of the two Microsoft DKIM records is missing. | Follow the setup steps for Google Workspace or Microsoft 365. |
| Not known (grey question mark) | Vaam could not complete the lookup. This status alone does not show a problem. | Select Check again later. |
A personal address, such as an address on gmail.com, outlook.com or hotmail.com, gets no check. Vaam shows that your email provider manages the sender records for that domain. You cannot change them.
The check is only information. It never stops or delays your emails.
With a public lookup tool
Section titled “With a public lookup tool”A DNS lookup tool shows the records that the internet sees for your domain. Use Google Admin Toolbox Dig or MXToolbox. Replace yourdomain.com with your domain:
| Record | Type | Name to look up | Value starts with |
|---|---|---|---|
| SPF | TXT | yourdomain.com |
v=spf1 |
| DKIM (Google) | TXT | google._domainkey.yourdomain.com |
v=DKIM1 |
| DKIM (Microsoft) | CNAME | selector1._domainkey.yourdomain.com and selector2._domainkey.yourdomain.com |
A Microsoft address |
| DMARC | TXT | _dmarc.yourdomain.com |
v=DMARC1 |
DNS changes can take up to 48 hours to show everywhere, but usually take less time.
Set up Google Workspace
Section titled “Set up Google Workspace”Use these steps when your company’s mail runs on Google Workspace.
- Find the TXT record that starts with
v=spf1on your domain. - If no record exists, add a TXT record on your domain with this value:
v=spf1 include:_spf.google.com ~all - If a record exists, add
include:_spf.google.comto it before theallterm. Do not add a second SPF record.
See Google’s guide Set up SPF.
- Sign in to the Google Admin console as an administrator.
- Go to Apps > Google Workspace > Gmail > Authenticate email.
- Select your domain and select Generate new record. Keep the selector prefix
google. - Add the TXT record that Google shows to your DNS. Its name is
google._domainkey. - Wait for the record to show in DNS. Then go back to Authenticate email and select Start authentication.
See Google’s guide Set up DKIM.
Add a TXT record with the name _dmarc on your domain. See Start with a safe DMARC record for the value.
See Google’s guide Set up DMARC.
Set up Microsoft 365
Section titled “Set up Microsoft 365”Use these steps when your company’s mail runs on Microsoft 365.
- Find the TXT record that starts with
v=spf1on your domain. - If no record exists, add a TXT record on your domain with this value:
v=spf1 include:spf.protection.outlook.com -all - If a record exists, add
include:spf.protection.outlook.comto it before theallterm. Do not add a second SPF record.
See Microsoft’s guide Set up SPF.
Microsoft 365 uses two DKIM records. Add both.
- Open the Microsoft Defender portal and go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings.
- Select the DKIM tab and select your domain. The portal shows two CNAME records, one for
selector1._domainkeyand one forselector2._domainkey. - Add both CNAME records to your DNS with the values that Microsoft shows.
- Wait for the records to show in DNS. Then go back to the DKIM tab and turn on Sign messages for this domain with DKIM signatures.
See Microsoft’s guide Set up DKIM.
Add a TXT record with the name _dmarc on your domain. See Start with a safe DMARC record for the value.
See Microsoft’s guide Set up DMARC.
Start with a safe DMARC record
Section titled “Start with a safe DMARC record”Use this value for your first DMARC record. Replace yourdomain.com with your domain:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comp=nonetells providers to deliver emails that fail the checks as usual. This record meets the Gmail and Yahoo rules.rua=sets the address that gets daily reports. Use an address that can receive a large number of reports.
Read the reports for a few weeks. Make sure that all services that send email for your domain pass SPF or DKIM.
Then change the policy to p=quarantine, which sends failed emails to spam. Later, change it to p=reject, which blocks failed emails.
A stricter policy too early can stop real email from your other services, such as a newsletter or invoicing tool.
Limits of the Vaam check
Section titled “Limits of the Vaam check”The Vaam check does not cover every setup:
- Custom Google DKIM selector. Vaam checks only the selector
google. If your administrator chose a different selector prefix in the Admin console, Vaam shows DKIM as needing attention, even when DKIM works. - Microsoft DKIM. Vaam requires both the
selector1andselector2records. If only one exists, Vaam shows DKIM as needing attention. - SPF provider. Vaam looks for
include:_spf.google.com(Google Workspace) orinclude:spf.protection.outlook.com(Microsoft 365) in your SPF record. Vaam also follows the otherinclude:entries in your record. A record that allows your provider in a different way shows as needing attention. - Subdomain mailbox. If your mailbox address is on a subdomain, such as
you@mail.yourcompany.com, Vaam checks DMARC only on that subdomain. Vaam does not use the DMARC record of the parent domain. Email providers do use it, so DMARC can show as needing attention even when it works.
If a check shows a problem that you think is wrong, use a public lookup tool to confirm your records.