How to setup MX, SPF, DKIM, DMARC
A comprehensive guide to configuring DNS records for your email domain. Follow these steps to ensure your emails reach the inbox.
Before You Start
You'll need access to:
- • Your domain registrar (where you bought your domain)
- • Your email provider's admin panel (Google Workspace, Microsoft 365, etc.)
Common registrars: Namecheap, GoDaddy, Cloudflare, Google Domains, Squarespace
MX Records (Mail Exchange)
MX records tell other mail servers where to deliver emails for your domain. These are usually set up by your email provider.
Google Workspace MX Records
| Priority | Mail Server |
|---|---|
| 1 | ASPMX.L.GOOGLE.COM |
| 5 | ALT1.ASPMX.L.GOOGLE.COM |
| 5 | ALT2.ASPMX.L.GOOGLE.COM |
| 10 | ALT3.ASPMX.L.GOOGLE.COM |
| 10 | ALT4.ASPMX.L.GOOGLE.COM |
Microsoft 365 MX Records
| Priority | Mail Server |
|---|---|
| 0 | yourdomain-com.mail.protection.outlook.com |
Replace "yourdomain-com" with your actual domain (dots replaced with dashes).
SPF Record (Sender Policy Framework)
SPF tells receiving servers which mail servers are authorized to send email for your domain. Add this as a TXT record at your domain root.
Google Workspace SPF
v=spf1 include:_spf.google.com ~allMicrosoft 365 SPF
v=spf1 include:spf.protection.outlook.com ~allImportant: Only One SPF Record
You can only have one SPF record per domain. If you use multiple email providers, combine them into a single record:
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~allDKIM Record (DomainKeys Identified Mail)
DKIM adds a digital signature to your emails. You'll need to generate the DKIM key from your email provider, then add it as a TXT record.
Google Workspace DKIM Setup
- 1.Go to Google Admin Console → Apps → Google Workspace → Gmail → Authenticate Email
- 2.Click Generate New Record for your domain
- 3.Copy the generated TXT record value
- 4.Add a TXT record at your registrar with host
google._domainkey - 5.Return to Google Admin and click Start Authentication
Microsoft 365 DKIM Setup
- 1.Go to Microsoft 365 Defender → Email & collaboration → Policies → DKIM
- 2.Select your domain and click Create DKIM keys
- 3.Add the two CNAME records shown to your DNS
- 4.Return to Microsoft and enable DKIM signing
DMARC Record
DMARC tells receiving servers what to do if SPF or DKIM checks fail. Add this as a TXT record with the host _dmarc.
Basic DMARC Record (Recommended for Start)
_dmarcv=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comReplace yourdomain.com with your actual domain.
DMARC Policy Options
p=none- Monitor only, don't reject emails (start here)p=quarantine- Send failing emails to spamp=reject- Reject failing emails entirely (strictest)
Start with p=none to monitor, then tighten as needed.
Where to Add DNS Records
Add DNS records at your domain registrar. Here's where to find DNS settings for common providers:
Namecheap
Domain List → Manage → Advanced DNS
GoDaddy
My Products → DNS → Manage Zones
Cloudflare
Select Domain → DNS → Records
Google Domains
My Domains → DNS → Custom Records
Verify Your Setup
After adding DNS records, it can take up to 48 hours for changes to propagate (usually much faster). Use Outlio's built-in tool to verify your setup.
Test Domain Setup in Outlio
Go to Email Accounts and click the Test Domain Setup button. Outlio will check your MX, SPF, and DMARC records automatically.
Learn more about testing →Next Steps
Was this article helpful?