SSalesCrew

Sending · 20 min per domain · reviewed 2026-09-06

How do I set up SPF, DKIM and DMARC for a sending domain?

Three DNS records tell mail providers your domain is real: SPF lists who may send for it, DKIM signs each message, DMARC says what to do when a message fails. Every service that sends for the domain (your mailbox provider, Instantly, Salesforce) needs to be in SPF and to have its own DKIM key.

What you will need

  • Access to the domain's DNS (Cloudflare, GoDaddy, Namecheap, Route 53).
  • The DKIM records from each sending service.

Steps

  1. 1

    Step 1

    SPF: one TXT record at the root. Include every sender, for example: v=spf1 include:_spf.google.com include:_spf.salesforce.com include:spf.instantly.ai ~all. Only one SPF record per domain; merge, do not add a second.

  2. 2

    Step 2

    DKIM: each service gives you a CNAME or TXT with a *selector*. Google: Admin console → Apps → Gmail → Authenticate email. Salesforce: Setup → DKIM Keys. Instantly: Settings → Domains. Add each record.

  3. 3

    Step 3

    DMARC: a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start with p=none to observe; move to p=quarantine after two clean weeks.

  4. 4

    Step 4

    Wait an hour, then send a test message to a Gmail address and open Show original.

Common errors

spf=permerror
more than ten lookups or two SPF records. Remove unused includes.
dkim=fail
the selector was added under the wrong name, or the key was regenerated after you copied it.
dmarc=fail while spf and dkim pass
the From domain differs from the signed domain. Sign with the From domain.

How you know it worked

The Gmail headers show spf=pass, dkim=pass and dmarc=pass for your domain. Settings → Sending domains shows the domain healthy after the next Instantly sync.

Where this goes in SalesCrew

A test message shows spf=pass, dkim=pass and dmarc=pass in its headers. In your own workspace the same how-to opens beside the field, with your callback URLs filled in.

Related