How to Set Up SPF, DKIM and DMARC: Google Workspace, Microsoft 365 and IONOS (2026)

The short answer

To set up SPF, DKIM and DMARC, you add three things to your domain's DNS: one SPF record listing who may send for you, a DKIM key that lets receivers verify your signature, and a DMARC record telling them what to do with mail that fails. The values depend on your email provider. For the three providers most German companies use, they are:

DMARC is the same everywhere: a TXT record at _dmarc on your domain, starting with v=DMARC1; p=none; rua=mailto:[email protected]. Afterwards, run our free email deliverability check to confirm all three are live.

We verified these values against the official documentation of Google and Microsoft and against IONOS's public DNS in October 2026. Providers change details over time, so if your admin console shows a different value, use what it shows.

Before you start: three rules

1. One SPF record per domain. Two SPF records make the check fail every time. If you send through several services, put all of them into one record, for example v=spf1 include:_spf.google.com include:servers.example.com ~all.
2. At most ten DNS lookups in SPF. Every include, a and mx counts, including the ones nested inside the includes. Above ten, SPF returns a permanent error.
3. Never send cold email from your main domain. Outreach belongs on separate sending domains with their own mailboxes, warmed up first. Each of those domains needs its own SPF, DKIM and DMARC. Our guide to cold email infrastructure covers that setup.

You make all DNS changes where your domain is managed, usually your registrar or host, not inside Google or Microsoft.

Step 1: SPF

Google Workspace. Add a TXT record on the domain with v=spf1 include:_spf.google.com ~all. Google recommends ~all.

Microsoft 365. Add a TXT record with v=spf1 include:spf.protection.outlook.com -all. Microsoft recommends -all, because with DKIM and DMARC in place it lets DMARC act on mail that fails SPF. If you also send from an on-premises server, add its address with ip4: in the same record.

IONOS. For domains whose DNS and mail sit at IONOS, SPF is set up by default. If your domain's DNS is managed elsewhere but your mailboxes are at IONOS in Europe, add v=spf1 include:_spf-eu.ionos.com ~all. That include contains IONOS's European sending servers; we checked it in public DNS in October 2026.

Step 2: DKIM

Google Workspace. In the Admin console go to Apps, Google Workspace, Gmail, then Authenticate email, and generate a new record. Keep the default selector google and choose a 2048-bit key unless your DNS host only supports 1024. Publish the value as a TXT record at google._domainkey. Then wait: Google says DKIM can take up to 48 hours to start working after you add the record. Only after the record is live, go back and click Start authentication. If you only just activated Gmail, the key can take 24 to 72 hours to appear in the console.

Microsoft 365. In the Microsoft Defender portal, go to Email and collaboration, Policies and rules, Threat policies, Email authentication settings, and open the DKIM tab. Select your domain. Microsoft shows you two CNAME records: selector1._domainkey and selector2._domainkey, each pointing to a value Microsoft generates for your tenant. Newer tenants get targets ending in -v1.dkim.mail.microsoft, older ones point to your onmicrosoft.com domain. Copy the values exactly as the portal shows them, add both CNAMEs at your DNS host, then switch DKIM signing on in the portal.

IONOS. Check in your IONOS account whether DKIM records are published for your domain, or simply run our check, which looks for DKIM on the common selectors and lets you enter your own.

Step 3: DMARC

Add a TXT record at _dmarc on your domain:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none means "watch, do not block yet". The reports sent to the rua address show which services send in your name and whether they pass SPF and DKIM. After two to four weeks without surprises, move to p=quarantine, and later to p=reject if you want full protection against spoofing.

Why it matters now: Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since February 2024, and Microsoft has enforced similar rules for Outlook.com since May 2025. We explain what these sender requirements mean in practice in our article on email sender requirements.

Step 4: Check that it works

Run your domain through our free email deliverability check. It reads SPF, DKIM, DMARC, MX, MTA-STS and BIMI and tells you for each one what is missing or wrong. DNS changes can take a few hours to show up, so if something looks missing right after you added it, check again later.

The mistakes we see most often

• Two SPF records after switching providers, an old one and a new one. Merge them into one.
• Too many includes after years of adding tools. Remove services you no longer use.
• DKIM published but never switched on, especially in Google Workspace, where the Start authentication click is easy to forget.
• DMARC jumped straight to reject before anyone read a report, and suddenly invoices from the accounting tool stop arriving.
• Cold email sent from the main domain. Even with perfect records, one aggressive campaign can damage the domain your whole company depends on.

Good records are the entry ticket, not the whole game. Inbox placement also depends on warm-up, volume, list quality and the copy itself; our cold email deliverability guide goes through the rest. And in Germany, advertising email without prior consent is an unreasonable nuisance under the UWG even in B2B, whatever your DNS says. This is not legal advice.

Where KNK fits

For our clients we never touch the main domain. We set up dedicated sending domains, SPF, DKIM and DMARC, warm the mailboxes and monitor them continuously, and then we run the outreach, handle every reply and book the meetings, from 3,300 euros a month, all-inclusive (cold email agency, pricing).