Blog

A reliable SPF DKIM DMARC setup for affiliate emails starts with adding your email provider’s authentication records to DNS. Then enable signing, test a message, and start DMARC in monitoring mode before blocking failures. Don’t worry, if you follow a sequence of steps it’s very achievable.

It might sound technical, but you don’t need to become an email expert to get it working. You need the right records, the right DNS account, and a test that proves your autoresponder is sending properly.

Let’s work through an SPF DKIM DMARC setup – step by step.

Key Takeaways

• Publish one SPF record per domain, with all required sending services included.
• Enable DKIM in your email platform after publishing its DNS records.
• Start DMARC with p=none, review reports, and fix legitimate senders before enforcing a stricter policy.

What SPF, DKIM and DMARC Check

These three checks work together, but each has a different job.

The envelope sender normally appears as the Return-Path after delivery. It can differ from the address subscribers see.

Gmail, Yahoo and Outlook.com require SPF, DKIM and DMARC for bulk senders. Gmail’s sender requirements apply bulk-sender rules at around 5,000 messages daily to personal Gmail accounts.

Now, don’t wait until your list reaches that size. Get the foundation working while your sending volume is manageable.

Step 1. Choose Your Domain and Gather Records

Separate your sending streams

Use a branded address on a domain you control for your permission-based affiliate newsletter.

A marketing subdomain can separate newsletter operations from everyday business email. However, it doesn’t completely isolate your brand’s reputation.

For cold outreach, I recommend a separate, clearly branded domain rather than your main business domain. That reduces direct exposure, but it doesn’t excuse unwanted email or bypass provider rules.

Each sending domain or subdomain needs authentication configured for its actual sending setup. SPF isn’t inherited from a parent domain.

Collect records from every sender

List everything that sends email: your mailbox, autoresponder, website forms, and any sales platform.

Open each service’s domain-authentication settings. Your provider’s current documentation and account-generated records supply the exact values. These vary by provider, so a generic example isn’t your finished configuration.

If you’re choosing a platform, my affiliate marketing autoresponder comparison covers beginner-friendly options.

Add records at the company hosting your active DNS. If your nameservers point to Cloudflare, edits belong there, even if you bought the domain elsewhere.

Step 2. Publish One SPF Record

SPF normally uses a TXT record at your domain root, shown as @ or a blank Host field.

For a domain sending only through Google Workspace, this is a standard example:

v=spf1 include:_spf.google.com ~all

Here, Google’s servers are authorized. The final ~all gives other servers a soft-fail result.

Now, here’s the easy mistake to avoid: don’t add a second SPF record when connecting your autoresponder.

If SPF already exists, combine the required mechanisms into that existing record. Keep one v=spf1 opening and one ending policy. Don’t delete unrelated TXT records, such as website verification records.

Some autoresponders use their own Return-Path domain. Others provide a custom bounce-domain setup. Add SPF at the envelope sender domain your provider specifies, rather than guessing.

The SPF standard’s DNS lookup limit allows ten DNS-querying terms during evaluation. Nested includes count too. Exceeding that limit causes permerror, a permanent SPF error.

Remove obsolete sending services instead of piling on includes. An SPF checker can identify duplicate records and excessive lookups before you send.

Step 3. Publish DKIM and Turn Signing On

Add the provider-generated DNS record

Your provider creates the DKIM signature with a private key; the matching DKIM record publishes the public key through DNS.

The public key sits at a selector hostname, such as:

google._domainkey.example.com

Your provider supplies the selector. Don’t assume every service uses google.

For a TXT-based setup, the value commonly begins v=DKIM1; k=rsa; p= and continues with the complete public key. Copy that entire value.

Other providers supply CNAME records pointing to keys they manage. Use the supplied record type and destination.

At Namecheap and GoDaddy, the Host field normally contains only the subdomain portion, such as google._domainkey. Entering the full domain can create a duplicated hostname.

Activate signing in your email platform

Publishing DNS doesn’t always switch DKIM on. Return to your provider’s authentication screen and complete activation.

For Google Workspace DKIM setup, open Admin console, Apps, Google Workspace, Gmail, then Authenticate email. Select your domain, generate the record, publish it, and select Start authentication.

For Microsoft 365 DKIM configuration, use the DKIM settings in Microsoft Defender’s Email authentication settings. Publish both supplied selector CNAMEs, then enable signing for your domain.

Authenticate your autoresponder separately. Enabling DKIM for your business mailbox doesn’t automatically authenticate affiliate broadcasts sent through another platform.

Step 4. Start DMARC With Monitoring

Publish the monitoring record

Create a TXT record at:

_dmarc.example.com

In Namecheap or GoDaddy, enter _dmarc in the Host field, rather than the full hostname.

A monitoring record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Replace the example domain and reporting address with your own. Create the receiving mailbox first, or use the address supplied by a DMARC reporting service.

The rua destination receives aggregate reports showing sending sources and authentication results. These are usually XML attachments, so a reporting dashboard makes them easier to read.

With p=none, DMARC requests no enforcement action against failures. Other spam filtering still applies.

Understand alignment before tightening the policy

DMARC passes when at least one aligned method passes: SPF or DKIM.

For SPF, alignment compares the envelope sender domain with the visible From domain. For DKIM, it compares the signing domain, shown as d=, with that From domain.

Relaxed alignment allows related subdomains under the same organizational domain. For example, mail.example.com aligns with example.com.

Strict alignment requires an exact match. DMARC uses relaxed alignment by default. The optional aspf=s and adkim=s tags enable strict SPF and DKIM alignment.

A parent-domain DMARC policy also covers subdomains without their own DMARC record.

Step 5. Test a Real Affiliate Email

Send a test through your actual autoresponder, not just your everyday mailbox. Include the normal footer and tracking links.

DNS changes often appear within 30 minutes to one hour, but cached records can take up to 48 hours. Leave the default TTL unless your provider specifies otherwise.

In Gmail, open the message, select the three-dot menu, then Show original.

In the email headers, locate the receiving server’s Authentication-Results header. Check the Authentication-Results values below for the expected results:

spf=pass smtp.mailfrom=bounce@mail.example.com

SPF passed for the envelope sender domain. Under relaxed alignment, this subdomain matches a From domain of example.com.

dkim=pass header.d=example.com

The signature passed using a signing domain that matches your brand domain.

dmarc=pass header.from=example.com

At least one passing method aligned with the visible From domain.

Repeat the test for every sending service. A successful mailbox test doesn’t prove your website forms or autoresponder are authenticated.

Automated setup can save time, but the live message is still important. My domain setup guide for beginners covers that simpler setup route.

Step 6. Move to Quarantine, Then Reject

Keep monitoring until your reports cover every legitimate sending source, including less frequent broadcasts, receipts, and automated follow-ups.

There isn’t a magic waiting period. Fix unexplained failures before changing the policy.

When reports show legitimate sources consistently pass, change the DMARC policy from p=none to p=quarantine.

Keep p=quarantine in place through a normal sending cycle, reviewing reports and delivery results before moving to p=reject.

Keep your reporting address in the record throughout.

Google’s authentication FAQ confirms that p=none satisfies its minimum DMARC policy requirement. Monitoring is a sensible starting point, but gradual DMARC enforcement offers stronger protection against email spoofing and phishing.

Don’t jump straight to reject while an old autoresponder or website mailer still sends unauthenticated messages.

Common Authentication Failures to Fix

When you check your SPF DKIM DMARC setup, but SPF passes but DMARC fails? Compare domains. Your autoresponder may authenticate its own Return-Path while your visible From address uses your domain. Enable aligned DKIM or the provider’s custom Return-Path feature.

DKIM fails? Look for a wrong selector, incomplete public key, duplicated hostname, or signing that hasn’t been activated. Also check whether another system changed signed content after sending.

Forwarding causes a different problem. Say a subscriber forwards your newsletter to another mailbox. The receiving server now sees the forwarder’s IP, which usually isn’t authorized by your original SPF record.

DKIM can still pass if the signed content remains unchanged. If its domain aligns, DMARC can pass too.

An SPF failure during forwarding doesn’t automatically mean your original SPF record needs another server added.

Mailing lists that alter subjects or message bodies can also break DKIM.

Frequently Asked Questions About An SPF DKIM DMARC Setup

Does DMARC require both SPF and DKIM to pass?

No. One passing, aligned method is enough for DMARC. However, high-volume sender requirements still call for configuring both SPF and DKIM. Aim to make both work rather than depending on one.

Does authentication guarantee inbox placement?

No. Authentication establishes authorized sending and domain alignment, but complaints, reputation, content, and subscriber engagement still affect placement.

Build your list through clear opt-ins, preferably double opt-in. Keep unsubscribe links working and send useful follow-up. My affiliate email deliverability guide covers those practical habits.

Get Your Sending Foundation Working First

Start with your provider’s records, keep SPF to one record per domain, and enable DKIM signing. Then use live message headers and DMARC reports to prove your setup works.

Once legitimate mail consistently passes, tighten your DMARC policy gradually. You’ll have a stronger foundation for affiliate follow-up without blocking your own campaigns through a rushed DNS change.