How to Set Up SPF, DKIM, and DMARC

SPF, DKIM, DMARC Setup in India: Complete Email Authentication Guide

If you run a business in India and send emails, whether it’s sending invoices to vendors in Surat, order confirmations to customers in Delhi, marketing newsletters to subscribers in Mumbai, or OTPs to users across India, you should know that the rules of sending emails have permanently changed.

The simple days when Indian businesses used to buy a domain, link it to an email service, and start blast-sending emails without any technical configuration are gone. Leading global email providers, Google, Yahoo, and Microsoft, have made SPF, DKIM, and DMARC mandatory for bulk senders who send 5,000 or more emails to personal accounts every day.

Today, if you want to reach prospects and customers in large numbers via email, you must authenticate your sending domain. If your DNS records are not configured properly, your emails will end up in the spam folder. They will be rejected by the receiving servers.

Our plain-English guide simplifies confusing technical jargon and shows exactly how Indian businesses can secure their domain with SPF, DKIM, and DMARC.

What Are SPF, DKIM, and DMARC?

You read that DNS setup is important for email authentication. But what exactly are these? Well, SPF, DKIM, and DMARC are three security checks for your domain's email. If you don’t configure your domain with these, your email will go to spam.

We have explained the three terms below in simple language with no jargon.

What is SPF (Sender Policy Framework)?

The full form of SPF is Sender Policy Framework. It is the most basic form of email authentication that allows you to specify the email servers that will send emails on behalf of your domain. Basically, it lists all the IP addresses to send emails. This helps prevent spammers from sending emails using your domain name.

When you send emails from your domain, Gmail checks your domain’s SPF to ensure it is authorised to send emails. If Gmail finds it authorised, your emails will be delivered. If not, it will be rejected. However, your domain’s SPF is not the only factor Gmail uses to reject your email. DKIM and DMARC, sender reputation, and other factors play an important role in determining whether to deliver or reject your emails.

What is DKIM (DomainKeys Identified Mail)?

DomainKeys Identified Mail adds a signature to your email. Servers verify these signatures to determine whether the email was actually signed by your domain and was not changed on its way. If the signature matches, the email is authorised. DKIM fails when your email’s digital signature doesn’t match or cannot be verified.

So, DKIM is the digital signature (cryptographic signature) that signals Gmail, Yahoo, and Outlook that an email genuinely came from your domain and was not altered during its journey.

What is DMARC (Domain-Based Message Authentication, Reporting & Conformance)?

DMARC works together with SPF and DKIM. It tells a receiving server what to do if an email fails SPF and DKIM: whether to allow, quarantine, or reject. It also asks the receiver to send you (the domain owner) a report to monitor your email activity.

The DMARC policy levels are:

• p=none: If a fake email is sent, do nothing and deliver the email normally, but send me a report for monitoring.
• p=quarantine: When an email fails DMARC, you ask the receiver not to deliver it to the inbox but to put it in the spam folder.
• p=reject: This shows the email is 100% fake, so don’t deliver it even to the spam folder. Reject the email or block it completely.

Why Email Authentication is Important for Indian Businesses

SPF, DKIM, and DMARC setup in India for small and large enterprises is essential for several reasons. But it is mainly important to protect your business reputation from phishing attacks targeting your brand’s name. Phishing attacks or domain spoofing happen when a hacker pretends to be your business using your exact email address.

If your domain is well aligned with SPF, DKIM, and DMARC, your emails are less likely to land in the spam folder. This means email authentication directly impacts your domain reputation and inbox placement. And this is why email authentication is essential for Indian businesses.

Stops Hackers from Spoofing Your Domain

We all know that email authentication is important, but it is now required by major email providers such as Gmail, Yahoo, and Outlook.

However, it offers several important advantages, one of which is preventing someone from spoofing your domain. Without SPF, DKIM, and DMARC, anyone can send email on your behalf and ask clients to pay into different accounts. But after the security checks, the server verifies the sender and rejects fake emails.

Improves the Chances of Email Reaching Inboxes

Email authentication is mandatory. If you don’t have SPF, DKIM, and DMARC, Gmail will put your email in spam and block it completely or won’t deliver it at all. Proper authentication improves email deliverability.

Protects Your Brand Reputation

The absence of SPF, DKIM, and DMARC records on a domain not only affects email delivery but also your brand reputation. If someone tries to send fake emails using your domain name, authentication policies will help receiving servers reject or block such emails. This protects your brand’s reputation.

Builds Trust With Email Providers

When your email is properly authenticated, the receiving server receives stronger signals about the sender; this confirms the email is from an authorised domain.

How to Set Up SPF, DKIM, and DMARC

Before you start the process, check whether these email authentication protocols are set up in your domain. There are many tools to check this.

But if you haven’t, you should do the following:

Know Who Sends Email for Your Domain

Most businesses in India send emails for various services. For example, an online clothing store in Chennai has a domain name “abctraders.in.” It is possible that the company is using the same domain for various services, such as marketing, employees, customer support, and orders/OTPs. This way, the company has different systems sending emails for its domain.

Now, suppose you send an email through “help@abctraders.in.” The receiving server may not be able to identify who sent this email. If you haven’t told Gmail which services are legitimate, it may not determine that the email is genuine.

In simple terms, before you set up the email authentication protocols, decide who is allowed to send emails through your domain.

Access Your Domain’s DNS (Domain Name System)

Before you set up SPF, DKIM, and DMARC, you should access your domain’s DNS settings. This is where you save the authentication records. Log in to your DNS provider’s account, such as GoDaddy, Hostinger, Cloudflare, or Squarespace Domains.  Log in to your email admin console to get your DKIM record.

Now comes the step-by-step process for setting up SPF, DKIM, and DMARC.

SPF Record Setup

SPF setup requires creating a simple text (TXT) record in your DNS provider, such as GoDaddy, Hostinger or Google Domains. For this, go to the management console for your domain host, where you will see the option to update your DNS TXT records. Fill out the fields, such as:

• Type: Select TXT
• Host/Name: You will use @ unless your DNS has provided a different value.
• Value: Just copy-paste the SPF record that your email service provider has provided you.
• TTL: This controls how long DNS servers should store a DNS record (cache) before checking for an updated version. You can leave it as default/3600 or 1 hour; no need to change it.

Save these changes, and you are done. It usually updates in 30 minutes to 4 hours, but may take up to 24 hours.

DKIM Configuration

This is similar to SPF setup, but your email provider usually gives you a DKIM selector or CNAME or TXT record that you add to your DNS. Here are the steps:

• Get your DKIM record by logging in to the platform you use to send emails and opening its DKIM or domain authentication settings. The provider will give you the required record type, host, and value.
• Open the account where your domain’s DNS is managed.
• Select the record type your provider has provided and enter the other details: Type, Host/Name, Value, and TTL.
• Save the records and go back to the service provider to check for options such as Verify DKIM, Authentication Domain, or Check DNS. When the DNS record is detected, you can see the DKIM showing “Activated” or “Verified”.

One important thing to focus on during DKIM configuration is that the selector, CNAME, and TXT values depend on the type of email service you are using. Do not change anything; copy-paste exactly as given.

DMARC Policy Setup

Just like SPF and DKIM, DMARC also requires creating a TXT record. This record helps Gmail decide what to do if an email fails email security protocols. Well, the steps for DMARC setup are the same as those for SPF and DKIM; the only difference is the Host and Value.

• Host/Name: This is written as an underscore like this: _dmarc and not @. 
• Value: v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

The policy p=none tells Gmail that if an email fails security checks, it should be delivered normally and a report should be sent to me. After 2 weeks, you can change p=none to p=quarantine to send fake emails to the spam folder. And after 30 days, change it to p=reject to block fake emails completely.

One important rule you must know is that you can only have one DMARC record. If you already have one, edit the existing one but do not add a second.

Common Mistakes to Avoid

SPF, DKIM, and DMARC work together to ensure your domain is a legitimate email sender and your emails don’t land in the spam folder. These protocols establish your brand reputation and increase email deliverability. However, many businesses make common mistakes that affect sender reputation and cause emails to end up in spam.

More Than One SPF Record

It is the most common mistake in India. Every business owner in India, before executing email marketing, should know that they can have only one SPF record. If you add the second one, both will break. If you already have one, just edit it; do not add a second.

DMARC Policy Setup with p=reject from Day One

If your SPF or DKIM has small errors, p=reject will block your own valid emails. Your message is neither delivered to the inbox nor sent to spam; it will be rejected altogether. This is why you should begin with p=none for 2 weeks, then switch to p=quarantine, and then finally choose p=reject.

Not Enabling DKIM After Adding DNS

It is the most common DKIM mistake Indian businesses make. Businesses add the record to the DNS at Hostinger or GoDaddy and think it is sufficient. But it is not enough. You also have to enable DKIM signing with your email provider.

No DKIM Monitoring

Many businesses in India set DKIM but never monitor the records. It is important to monitor DKIM records, especially when you change your DNS provider or your key expires, because then DKIM can fail silently and your emails will end up in spam. You should check DKIM status once a month and rotate your DKIM keys every 6-12 months.

Conclusion

The email authentication protocols SPF, DKIM, and DMARC may sound technical, and business owners may even find it difficult to set up. Well, these are simple TXT records in your DNS that decide whether your email reaches the inbox or spam folder. Remember that these email providers have made it clear that if you send emails, you must prove that you are authorised to send them. Without authentication, even your genuine invoices, OTPs, and order confirmation messages will be rejected.

But now you already know how to set up SPF, DKIM, and DMARC. Just follow the steps as discussed and stop hackers from spoofing your emails. If you need any help in setting up these protocols correctly for the domain, contact us. We can do it for you in a few minutes, so your emails always land in the inbox.