Fix your domain's email records

Fix 1 — No DMARC record (the most common one)

DMARC is the rule that tells receiving mail servers what to do with email that pretends to be you. Without it, fakes sail through. Adding a starter record is safe: in monitoring mode it changes nothing about your mail flow — it just starts sending you reports.

1. Sign in to wherever your domain's DNS is managed (often your domain registrar or your web host) and find Add record.

2. Add a TXT record with the host/name _dmarc and this value, using an email address you control:

   v=DMARC1; p=none; rua=mailto:you@yourdomain.com

3. Wait an hour or two, then re-run the DMARC check at MXToolbox. Your domain should now show a valid record.

4. After a week or two of reports showing only your real mail services, strengthen the policy: change p=none to p=quarantine (fakes go to spam), and later to p=reject (fakes are refused outright).

Fix 2 — SPF missing or broken

SPF is the public list of services allowed to send email for your domain. If you send from Google Workspace or Microsoft 365 and the list is missing, receivers have no way to confirm your mail is yours.

1. In your DNS, look for an existing TXT record on your root domain (host @) that starts with v=spf1. There must only ever be one — two SPF records break both.

2. If there is none, add one matching the service you send from:

   Google Workspace:  v=spf1 include:_spf.google.com ~all Microsoft 365:      v=spf1 include:spf.protection.outlook.com ~all

3. If you also send through other tools (a newsletter service, your website's contact form, invoicing software), add each one as another include: in the same record — ask each tool's support for its exact include. Then re-check: SPF fails if a record needs more than 10 DNS lookups, and a good checker will warn you if you're close.

4. Keep the ending as ~all while testing. Once everything legitimate is listed, you can tighten it to -all.

Fix 3 — DKIM not switched on

DKIM signs each outgoing email so receivers can prove it wasn't altered. On most platforms the feature exists but was never enabled.

If you use Google Workspace

1. Open the Google Admin console → Apps → Google Workspace → Gmail → Authenticate email.

2. Choose Generate new record. Google shows you a TXT record to publish — add it in your DNS with the exact host and value it gives you.

3. Back in the Admin console, click Start authentication. Give it a day, then confirm with the DKIM check at MXToolbox.

If you use Microsoft 365

1. Open the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.

2. Select your domain. Microsoft shows you two CNAME records to publish — add both in your DNS, exactly as shown.

3. Back in the portal, switch DKIM on. Give it a day, then confirm with the DKIM check at MXToolbox.

The order matters

Do SPF and DKIM first, DMARC last. DMARC only passes when at least one of the other two lines up with your domain, and raising DMARC to quarantine or reject before your real services are covered is the one way to break your own mail. After each change, re-run the checks — DNS changes can take from a few minutes up to a few hours to show up everywhere.

This guide covers the standard setups above. If your mail runs through several different services, your records will need to cover each of them — the checkers will tell you which ones are still missing.