Imagine a client receiving an email that looks like it came from you (your name, your firm’s logo, your actual email address), asking them to update payment details. You never sent it. That’s email spoofing, and it’s one of the most common ways bookkeepers, accountants, and small firms get impersonated.

The good news: there’s a proven set of defenses called email authentication, made up of three DNS records (SPF, DKIM, and DMARC) that work together to tell the world which email servers are allowed to send as your domain, and what receiving servers should do with anything that isn’t. This guide walks you through setting up all three for the two most common business email platforms: Microsoft 365 and Google Workspace.

Every step below is free. The only cost is about an hour of focused time, and the DNS changes themselves take minutes.

What Email Authentication Actually Does

Think of your domain as your firm’s mailing address. Without authentication, anyone can print envelopes with your return address. Email authentication puts three locks on that address:

• SPF (Sender Policy Framework): your public list of approved senders. It’s a DNS record that says “only these email servers may send mail as mydomain.com.” Anything from an unlisted server fails the check.
• DKIM (DomainKeys Identified Mail): your digital signature. Your email platform adds an encrypted signature to every message you send, and publishes the public key in DNS so receiving servers can verify the message wasn’t altered in transit.
• DMARC (Domain-based Message Authentication, Reporting & Conformance): your policy and your report card. DMARC tells receiving servers what to do when SPF or DKIM fails (nothing, quarantine, or reject) and sends you daily reports showing exactly who is sending email as your domain, including impersonators.

Together, the three records make spoofing your domain dramatically harder and give you visibility you’ve never had before. Most firms that set up DMARC for the first time discover legitimate senders they forgot about, and a few they didn’t know existed.

Before You Start: Find Where Your DNS Lives

All three records are published in your domain’s DNS settings, which live wherever your domain’s nameservers point. For most small firms, that’s one of these places:

• Your domain registrar: GoDaddy, Namecheap, Cloudflare, Network Solutions, or wherever you bought the domain. Log in and look for “DNS” or “DNS Records” or “Manage Zones.”
• Your email provider: if you bought your domain through Microsoft 365 or Google Workspace when you signed up, your DNS may be managed there.
• Your website host: some hosts manage DNS alongside your website.

If you’re not sure, ask whoever set up your email, or check your registrar account first. That’s the most common location. You’ll need access to add three types of records: TXT records (for SPF and DMARC), CNAME records (for Microsoft 365 DKIM), and one more TXT record (for Google Workspace DKIM).

One rule that trips up almost everyone: a domain can only have one SPF record. If you already have an SPF record, you don’t add a second one. You merge the new include into the existing record. Two SPF records means both fail.

Setting Up Email Authentication for Microsoft 365

If your firm runs on Microsoft 365 (Outlook), follow these steps in order.

Step 1: Publish your SPF record

In your DNS manager, add a TXT record on your root domain (the host field is typically “@” or left blank):

v=spf1 include:spf.protection.outlook.com -all

If you already have an SPF record, merge this include into it rather than creating a second record. If you use third-party tools that send email as your domain (a newsletter platform, a billing system, a CRM), their SPF include goes in this same record. Check each vendor’s documentation for the exact value.

Step 2: Enable DKIM signing

1. Sign in to the Microsoft 365 Defender portal (security.microsoft.com) with an administrator account.
2. Go to Email & Collaboration → Policies & Rules → Email Authentication Settings, then select the DKIM tab.
3. Select your custom domain. If DKIM keys haven’t been created yet, click to create them.
4. Microsoft displays two CNAME records (selector1._domainkey and selector2._domainkey). Publish both in your DNS manager exactly as shown. If Microsoft manages your DNS, they may publish automatically.
5. Once the records resolve, return to the portal and toggle Enable signing for this domain, then save.

Microsoft’s portal verifies the records before letting you enable signing, so you’ll know immediately if something didn’t publish correctly.

Step 3: Publish your DMARC record

Add a TXT record with the host _dmarc (which becomes _dmarc.yourdomain.com):

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none: this is monitor-only mode. Nothing gets blocked yet; you simply receive daily reports showing every sender using your domain. Create a dedicated mailbox (like dmarc@yourdomain.com) to receive them, or use a DMARC report analyzer to make them readable.

Setting Up Email Authentication for Google Workspace

If your firm runs on Google Workspace (Gmail with your own domain), the steps are similar.

Step 1: Publish your SPF record

In your DNS manager, add a TXT record on your root domain:

v=spf1 include:_spf.google.com ~all

Same rule as before: one SPF record per domain, merged if you already have one.

Step 2: Enable DKIM signing

1. Sign in to the Google Admin console (admin.google.com) with an administrator account.
2. Go to Apps → Google Workspace → Gmail → Authenticate Email.
3. Select your domain and click Generate new record. Choose the 2048-bit key length. It’s stronger and costs nothing extra.
4. Google displays a TXT record with the host name google._domainkey. Copy the value and publish it in your DNS manager.
5. After DNS propagates (usually minutes to a few hours), return to the Admin console and click Start Authentication.

Step 3: Publish your DMARC record

Identical to Microsoft 365. Add a TXT record at _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

What About Other Email Providers?

Running on Zoho Mail, GoDaddy’s email, or email bundled with your web hosting? The pattern is identical: every reputable provider publishes their exact SPF include and DKIM setup instructions in their own documentation. Search for “[your provider] SPF setup” and “[your provider] DKIM setup” and follow their published values. The DMARC record above is universal: it’s the same for every provider.

Verify Your Setup Works

Don’t assume. Verify. Three free checks take under five minutes:

• MXToolbox (mxtoolbox.com): look up your domain’s SPF and DMARC records and confirm they parse correctly with no errors.
• Send a test email to a personal Gmail or Outlook account. Open it and choose “Show original” (Gmail) or view message source (Outlook). Look for the Authentication-Results header: you want to see SPF: pass, DKIM: pass, and DMARC: pass.
• Watch your DMARC reports for the first two weeks. They’ll show every sender using your domain, legitimate and otherwise.

Rolling Out DMARC the Right Way

DMARC works best in stages. After a couple of weeks of clean reports in monitor mode:

1. p=none: monitor only. Confirm every legitimate sender passes SPF and DKIM. Fix any gaps first.
2. p=quarantine: failing messages go to spam or quarantine. Receiving servers hold suspicious mail instead of delivering it.
3. p=reject: failing messages are refused outright. This is the goal state: impersonating your domain stops working.

Most firms reach reject within 4–8 weeks. The pace depends on how quickly you identify and fix every legitimate sender, which is exactly what the monitoring phase is for.

Common Mistakes to Avoid

• Two SPF records. The single most common error. Merge includes into one record.
• Forgetting third-party senders. Newsletter tools, billing systems, and CRMs often send as your domain. Add their SPF include and DKIM records before tightening your DMARC policy, or your own marketing email will start failing.
• Jumping straight to p=reject. Without a monitoring phase, you can block legitimate email, including invoices and client communications, before you know all your senders.
• Setting it and forgetting it. DMARC reports are the ongoing value. They tell you when a new tool starts sending as your domain, and when someone tries to spoof you.

Want Help Reading Your DMARC Reports?

Raw DMARC reports arrive as XML attachments, technically complete, practically unreadable. STM offers Kevlarr DMARC monitoring, which turns those reports into a plain-English dashboard: who’s sending as your domain, what’s passing, what’s failing, and what needs attention. It’s $15 per month per domain, and we set it up and monitor it for you.

If you’d rather have a technology partner handle the entire rollout (SPF, DKIM, DMARC, verification, and staged enforcement), schedule a consultation and we’ll take it from here. And if you just want the tools that pair with this guide, explore our subscription services.

This guide is provided for general informational purposes and reflects standard SPF, DKIM, and DMARC configuration for Microsoft 365 and Google Workspace as of October 2026. Your provider’s documentation is the final authority on exact record values.