SPF and DKIM setup for small business comes down to two kinds of DNS record. SPF is a TXT record that lists who may send mail for your domain. DKIM publishes a key so receivers can check that a message was signed by your domain. Neither guarantees an inbox, but a business domain without them gives receiving servers less reason to trust you.
These steps follow Google’s help pages for SPF, DKIM and DMARC (each showing “Last updated 2026-10-01 UTC”), Microsoft’s pages on SPF and DKIM (dated July 2026) and Zoho’s pages on SPF and DKIM (October 2026). All were read in October 2026.
SPF and DKIM setup for small business in brief
- SPF: one TXT record at your domain, listing every service that sends as you. Only one SPF record per domain.
- DKIM: a key you create in your mail system, then publish in DNS. Google and Zoho use a TXT record. Microsoft uses two CNAME records.
- Order: SPF, then DKIM, then test, then DMARC with
p=none. - Time: Google says SPF can take up to 48 hours to spread, and DKIM up to 48 hours to start.
- Check: send a test to a Gmail address and read the message headers.
What SPF and DKIM setup for small business involves
In plain words, here is what each record does.
SPF is defined in RFC 7208. Its abstract says a domain can explicitly authorise the hosts allowed to use its name, and a receiving host can check. The check is made against the sending address used in the SMTP exchange, which Microsoft calls the MAIL FROM or envelope sender.
DKIM is defined in RFC 6376. It lets the owner of a signing domain claim responsibility for a message. The public key sits in DNS under a selector, in the form selector._domainkey.yourdomain. The s= tag in the signature names the selector and d= names the domain.
DMARC builds on both. Google’s page says you must enable SPF or DKIM before DMARC and should wait 48 hours first. DMARC is now defined by RFC 9989, which the RFC Editor shows as replacing RFC 7489.
Before SPF and DKIM setup for small business: list every sender
SPF fails quietly when you forget a sender, which is the most common slip in SPF and DKIM setup for small business. Google’s first step is to list all the servers that send email for your domain: Google Workspace, on-premise servers, web servers, third-party services and outbound gateways. For a small business that usually means:
| Sender | Example | Needs a record? |
|---|---|---|
| Your mailboxes | Google Workspace, Microsoft 365, Zoho or hosting email | Yes: the provider’s SPF include and DKIM |
| A website form | A WordPress contact form or shop | Yes, if it sends as your domain; follow its vendor |
| A newsletter or invoicing tool | Any bulk or billing service | Yes: its vendor gives an include or DKIM value |
Microsoft advises using a subdomain for services you do not control, such as a bulk email service, so a problem there does not affect your main domain’s reputation. Each subdomain needs its own SPF record.
The seven steps of SPF and DKIM setup for small business
1. Choose your SPF record
Google’s page gives v=spf1 include:_spf.google.com ~all for Google Workspace on its own. Microsoft’s gives v=spf1 include:spf.protection.outlook.com -all for Microsoft 365 alone. Zoho’s gives v=spf1 include:zohomail.com -all. For two services, combine the includes in one record, as Google’s page does for Google plus Microsoft: v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all.
The vendors disagree on the ending. Google recommends ~all (soft fail). Microsoft recommends -all (hard fail) because it also recommends DKIM and DMARC. Zoho’s page shows -all and a ~all variant. If you are unsure, ~all is the gentler start, and switch only after you have listed every sender.
2. Add the SPF record at your DNS host
Google’s steps: sign in to your domain host, open the DNS TXT records page, and create or update a TXT record with Type TXT, Host @ (or your domain name) and your SPF text as the value. Microsoft notes there is no admin page in Microsoft 365 for SPF, so you create it at your registrar or DNS host.
Only one SPF record is allowed per domain. RFC 7208 section 4.5 says more than one results in permerror. If a record exists, edit it.
3. Check the SPF limits
RFC 7208 section 4.6.4 limits evaluation to 10 terms that cause DNS lookups, and exceeding it gives permerror. Microsoft’s page says include:, a, mx, exists and redirect each count as one lookup, while ip4:, ip6: and all do not. Includes can nest, so fewer than 10 include: words does not guarantee fewer than 10 lookups.
4. Generate the DKIM key
The DKIM half starts in your mail system, not in DNS. In Google Workspace, open the Admin console, then Menu > Apps > Google Workspace > Gmail, and select Authenticate email. Choose a key length: 2048-bit if your domain provider supports it, or 1024-bit if not. Keep the default selector prefix google unless your domain already uses it. Select Generate.
In Zoho Mail’s Admin Console, open Domains, pick the domain, open Email Configuration, choose DKIM, click Add, name the selector (the page’s example is zoho) and pick 1024 or 2048 bits.
In Microsoft 365, the Defender portal’s Email authentication settings page, reached through Email & collaboration > Policies & rules > Threat policies, lists the two CNAME values to publish.
5. Publish the DKIM record
| Provider | Record type | Host name | Value |
|---|---|---|---|
| TXT | The name shown in the console, in the _domainkey form | Text starting v=DKIM1 | |
| Zoho | TXT | selector._domainkey.yourdomain | The generated value |
| Microsoft 365 | Two CNAMEs | selector1._domainkey and selector2._domainkey | Values from the Defender portal; they differ for each domain |
For this part of the SPF and DKIM setup for small business, Zoho adds a warning: some DNS providers (it names GoDaddy, Wix, Squarespace and Namecheap) add the domain name for you, so you enter only zoho._domainkey as the host. Check your DNS host’s own help before you paste.
6. Turn DKIM on
For Google, go back to Authenticate email and click Start authentication. The status should read “Authenticating email with DKIM”. Google says it can take up to 48 hours to activate, and warns that a brand-new Workspace account should wait 24 to 72 hours after turning on Gmail before generating keys. Zoho has a Verify button for the selector, then an option to enable DKIM. Microsoft’s page says detecting the new CNAME records takes a few minutes or possibly longer, after which you can switch signing on.
7. Test your SPF and DKIM setup for small business
Testing is the step people skip, and it is the only proof the records work.
- Look up your TXT records with any free DNS lookup tool. Microsoft’s page notes that such tools can even count the lookups.
- Send a message from the domain to a Gmail address.
- Open the full message headers. Google’s DKIM page says to look for
Authentication-Resultsshowing DKIM as passing. - Look for SPF passing in the same header.
- If it fails, wait the stated time, then recheck the host name and value.
Then add DMARC. Google recommends starting with the policy p=none, which delivers mail and sends you reports, with the record at _dmarc.yourdomain. Set up a mailbox or group for the reports first.
Common mistakes in SPF and DKIM setup for small business
| Mistake | What happens | Fix |
|---|---|---|
| Two SPF records | permerror per RFC 7208 | Merge into one record |
Typos such as a trailing dot, include= or a space after the colon | SPF validation fails (Microsoft’s table) | Copy the vendor’s text exactly |
| A forgotten sender | Legitimate mail fails SPF | Inventory senders again |
| Over 10 lookups | permerror | Use subdomains or fewer services |
| Subdomain without a record | Not covered by the main record | Add its own SPF record |
| DNS managed elsewhere | A record added in one place is not seen | Edit DNS where the nameservers point. cPanel’s page says the same |
If your mail is on hosting, our comparison of cPanel email vs Google Workspace shows the cPanel tool that checks these records.
After SPF and DKIM setup for small business: a consistent signature
Authentication helps a receiver trust the sender. The signature is what the person reads. Here is a made-up example.
|
Example only. The company and person are made up. A signature does not change SPF or DKIM results.
For the wider setup, see our business email setup guide for Africa and the notes on Google Workspace for small business in Africa.
Keep SPF and DKIM setup for small business current
Every new tool that sends as your domain changes the answer, and SPF and DKIM setup for small business is never quite finished. Add a line to your onboarding for new software: “Does it send email as us, and has its SPF or DKIM record been added?” A short SPF and DKIM setup for small business, kept current, beats a long one nobody maintains. If you are still choosing a mail provider, compare Gmail with a business email address first.
Frequently asked questions
Do I need both for SPF and DKIM setup for small business?
Gmail’s sender guidelines say all senders should set up SPF or DKIM, and senders of 5,000 or more messages a day to Gmail need both plus DMARC. Google’s SPF page recommends setting up DKIM and DMARC as well.
How long does SPF and DKIM setup for small business take to work?
Google’s SPF page says up to 48 hours to propagate, and its DKIM page says up to 48 hours for DKIM to activate. Microsoft says a few minutes or possibly longer to detect CNAME records.
Can I have two SPF records?
No. RFC 7208 says more than one SPF record gives a permanent error. Put all your senders in one record.
Will SPF and DKIM setup for small business stop my email going to spam?
They help receivers trust you, but they are not the only factor, and none of the pages we read promises inbox delivery. Spam rates and content matter too.
Keep reading
- cPanel email vs Google Workspace: which suits a small business?: cPanel email vs Google Workspace for a small business: deliverability, storage, collaboration, security and cost, from vendor pages read in October 2026.
- Google Workspace for small business in Africa: costs, setup and alternatives: Google Workspace for small business in Africa: the euro prices on Google’s page, how African cards pay, the DNS and MX setup steps, and cheaper options.
- How to set up professional business email for an African company: Business email setup Africa guide: pick a domain, compare Zoho, Google Workspace, Microsoft 365 and cPanel on public prices, add DNS records and a signature.
- Gmail vs business email: what it signals and what it costs: Gmail vs business email compared honestly: how each looks, what you control, the real cost from Google, Zoho and Microsoft pages, and when to switch.
Make every signature in your company match
emailfooter is a free WordPress plugin. You design the signature once, and each person adds their own details and installs it in their mail app. Prefer not to run a website? emailfooter Managed is the same software, hosted for you.