Four records with different jobs
MX identifies the servers that accept incoming mail for a domain. SPF describes authorized sending systems for the envelope sender domain. DKIM lets a receiving system verify a domain’s message signature using a published public key.
DMARC checks alignment with the visible From domain and publishes a policy for messages that fail its checks. Passing authentication is useful evidence, but it does not guarantee inbox placement.
Sources: Set up SPF · Set up DKIM · Set up DMARC
Inventory every legitimate sender
List employee mail, website forms, invoice systems and any service that sends using your domain. Record who controls each service and where its current setup instructions are stored. This inventory prevents a forgotten service from being disrupted by an authentication change.
Do not publish multiple competing SPF policies for one hostname or paste another organization’s record. Ask your provider to check the combined configuration and its DNS lookup limits. Publish only public DKIM information in DNS; private signing keys stay with the sending system.
Make a reversible change plan
Save the current records, the exact new values supplied by your provider, and the person responsible for testing. Keep website records outside the mail change untouched. Treat examples in guides as explanations rather than values ready for your domain.
For DMARC, review legitimate sending paths before tightening policy. Google’s rollout guidance recommends starting with monitoring and progressing after reviewing authentication. A strict policy applied before legitimate senders are configured can interfere with valid mail.
Sources: Set up DMARC
Verify the messages as well as DNS
Send representative messages from each approved service to test recipients. Inspect the authentication results and the visible sender. Test incoming mail separately, because a successful SPF check does not prove that MX delivery is correct.
- Before: records exported, senders inventoried, rollback owner assigned.
- During: provider-specific values applied and change time recorded.
- After: inbound delivery, replies and authentication checked for each sender.
- Follow-up: reports reviewed and obsolete senders removed only after verification.
Keep the evidence
Record the result and date for each sending path. If a later website form or billing service is added, revisit the inventory. DNS authentication is a maintained configuration, not a one-time badge.
Sources
- Set up SPF — Google Workspace Help. Reviewed .
- Set up DKIM — Google Workspace Help. Reviewed .
- Set up DMARC — Google Workspace Help. Reviewed .