If you use a branded email address for sales, support, invoices, outreach, or newsletters, email authentication is no longer optional background admin work. It is now part of basic business hygiene.
Google says that starting February 1, 2024, all senders to Gmail accounts must meet its sender requirements, while senders of more than 5,000 messages per day to Gmail accounts must meet additional bulk-sender requirements. You can review those rules in Google’s Gmail sender guidelines.
For small businesses, the practical takeaway is simple: set up SPF, DKIM, and DMARC on your domain, then roll them out carefully.
What SPF, DKIM, and DMARC do
| Method | What it does | Why it matters |
|---|---|---|
| SPF | Lists which servers are allowed to send email for your domain | Helps receiving systems identify valid sending sources |
| DKIM | Adds a cryptographic signature to outgoing mail | Helps verify that the message is authorized and was not altered |
| DMARC | Tells receiving systems how to handle messages that fail checks and where to send reports | Helps reduce spoofing and gives you visibility into who is sending mail on your domain |
Google Workspace recommends setting up SPF and also recommends DKIM and DMARC; for bulk senders, Google requires all three. Google’s setup guidance is here: Set up SPF.
Microsoft makes a similar point from another angle: DKIM alone is not enough for custom domains, and it should be combined with SPF and DMARC.
Why this matters for small businesses
These records can reduce spoofing risk on your business domain and may improve deliverability, but they do not guarantee inbox placement. Google’s documentation makes clear that sender reputation and compliance still matter. In practice, proper authentication is especially useful for:
- customer support replies
- contact-form notifications
- invoices and account emails
- newsletters and marketing campaigns
- messages sent from third-party tools
It also helps you find forgotten or unauthorized sending services through DMARC reporting.
Before you start
Make a list of every service that sends email using your domain. That may include Google Workspace, Microsoft 365, newsletter platforms, help desks, ecommerce tools, CRMs, and transactional mail providers.
This matters because there is no single SPF record that fits every business. The correct record depends on your actual sending services.
Step 1: Publish one SPF record
SPF is a TXT record in DNS. Its job is to identify valid sending sources for your domain.
Official examples include:
- Google Workspace only: v=spf1 include:_spf.google.com ~all
- Microsoft 365 only: v=spf1 include:spf.protection.outlook.com -all
Those examples come from Google Workspace and Microsoft documentation.
Two important SPF rules from Microsoft:
- Use only one SPF record per domain or subdomain. Multiple SPF TXT records can cause permerror.
- SPF has a 10 DNS lookup limit. Too many include: mechanisms can break validation.
You can check Microsoft’s setup guidance here: Set up SPF for Microsoft 365.
Practical tip
If your company uses Google Workspace plus another sender such as a newsletter platform, do not publish two SPF records. You need one SPF record that accounts for all legitimate senders.
Step 2: Enable DKIM for each sending domain
DKIM signs your outgoing email so receiving systems can verify that it was sent by an authorized system and that the message was not altered in transit.
For Google Workspace, Google says you may need to wait 24 to 72 hours after enabling Gmail before you can generate a DKIM key in the Admin console. Google also recommends 2048-bit keys when supported. The instructions are in Google’s DKIM setup guide.
For Microsoft 365, custom domains need DKIM configuration for each sending domain or subdomain. That detail is easy to miss if you send from multiple subdomains.
Common mistake
Some businesses enable DKIM on their main domain but forget subdomains used by marketing or support tools. If those systems send mail without proper alignment, DMARC can still fail.
Step 3: Add DMARC, but start safely
DMARC ties everything together. It checks alignment between the visible From domain and the identities used by SPF or DKIM, and it tells receiving systems what to do when messages fail.
Microsoft says a message passes DMARC if either SPF or DKIM passes alignment. It fails only when both alignment checks fail. Google’s DMARC guidance uses the same general alignment-based approach.
A basic DMARC record looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]
Google recommends a staged rollout:
- Start with p=none
- Review reports
- Move to p=quarantine
- Then move to p=reject once legitimate senders are covered
That advice comes directly from Google’s DMARC setup guide.
How to read the first results
When you start with p=none, DMARC reports can show which systems are sending mail that claims to be from your domain. That gives you a safer way to find gaps before you quarantine or reject anything.
Look for:
- legitimate tools you forgot to include in SPF
- domains or subdomains missing DKIM
- unexpected senders you do not recognize
Do not rush to p=reject just because the record is live. A stricter policy is useful only after your legitimate senders are correctly authenticated.
Known caveats
Email authentication is not perfectly simple in real-world delivery.
- Forwarding and mailing lists can complicate DMARC. Microsoft notes that legitimate messages can fail after forwarding or list handling.
- Receiver behavior is not identical everywhere. DMARC sets a requested policy, but mailbox providers can still apply their own filtering logic.
- This is not a one-time task. If you add new tools later, your SPF, DKIM, and DMARC setup may need updates.
A simple rollout checklist
- List every service that sends email from your domain
- Publish one SPF record only
- Check that your SPF record stays within the 10-lookup limit
- Enable DKIM for your main domain and any sending subdomains
- Add a DMARC record with p=none
- Review reports and fix missing senders
- Move to p=quarantine, then p=reject when ready
One final standards note
If you are reviewing technical references, the formal DMARC standard was updated in RFC 9989, published by the IETF in May 2026, which obsoletes RFC 7489.
Bottom line
For a small business domain in 2026, SPF, DKIM, and DMARC should be treated as standard setup, not optional extras. Google and Microsoft both point in the same direction: use all three, roll out DMARC gradually, and keep your sending services documented.
That approach will not solve every deliverability problem, but it can reduce spoofing risk and give you much better control over how your domain is used in email.
Sources
- Email sender guidelines – Gmail Help
- Set up SPF | Apps & integrations | Google Workspace Help
- How to use DKIM for email in your custom domain – Microsoft Defender for Office 365 | Microsoft Learn
- Set up DMARC to validate email in Microsoft 365 – Microsoft Defender for Office 365 | Microsoft Learn
- RFC 9989 – Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
- Set up DMARC | Security & data protection | Google Workspace Help
- Set up SPF to identify valid email sources for your Microsoft 365 domain – Microsoft Defender for Office 365 | Microsoft Learn
- Set up DKIM | Security & data protection | Google Workspace Help





