SPF, DKIM and DMARC for course creators: what each record does

What each record proves

SPF answers "is this server allowed to send for this domain?". Google's setup guide says receiving servers check your SPF record to confirm messages came from authorized senders. Google's example for a domain that only sends through Workspace is v=spf1 include:_spf.google.com ~all.

DKIM answers "was this message signed by the domain, and unchanged since?". Google explains that your mail server signs each outgoing message with a private key, and receivers verify it with the public key published as a DNS TXT record under a selector followed by ._domainkey. Google recommends 2048-bit keys where the DNS host supports them; Gmail requires at least 1024 bits for mail to personal accounts.

DMARC answers "what should happen if this mail fails, and who should hear about it?". It is a TXT record at _dmarc on your domain with a policy of none, quarantine or reject, and an optional rua address for aggregate reports. The DMARC specification RFC 7489 (which the RFC Editor page now marks as obsoleted by RFCs 9989, 9990 and 9991) says a message passes when at least one of SPF or DKIM passes with an identifier aligned to the From domain; relaxed alignment only requires the same organizational domain.

How Gmail and Yahoo requirements apply to course email

Gmail's sender guidelines apply from 1 February 2024. For all senders: set up SPF or DKIM, have valid forward and reverse DNS (PTR) for sending IPs, use TLS, keep the spam rate in Postmaster Tools below 0.3%, and follow RFC 5322 formatting. Senders of 5,000 or more messages a day to Gmail accounts must also use both SPF and DKIM, publish DMARC (the policy can be none), align the From domain with the SPF or DKIM domain, and support one-click unsubscribe on marketing and subscribed messages. Gmail recommends keeping spam rates below 0.10%.

Yahoo's sender best practices are close: SPF or DKIM for everyone; both SPF and DKIM for bulk senders, a valid DMARC policy of at least p=none that passes, From-domain alignment, a working list-unsubscribe header with one-click support for marketing and subscribed messages, and unsubscribes honored within 2 days. Yahoo did not define a bulk-sender threshold on the page we read.

For a course business, enrollment confirmations, password resets and payment receipts are transactional. Gmail's page names marketing and subscribed messages for one-click unsubscribe and does not say transactional mail is exempt from other rules, so authenticate everything. A launch sequence to your list is marketing mail and does need one-click unsubscribe once you are a bulk sender.

List every source that sends as your domain

Most authentication problems come from a sender nobody remembered. A typical course site has four or five. Each one either signs with DKIM for your domain or does not, and each one must be authorized in your single SPF record if it sends from its own servers with your domain in the envelope.

SPF limits that catch course sites

RFC 7208 says a domain must not have multiple SPF records, and when a lookup finds more than one, the result is a permanent error. When a new tool asks you to "add an SPF record", merge its include into the existing one.

The same RFC limits SPF evaluation to 10 terms that need DNS lookups: include, a, mx, ptr and exists mechanisms and the redirect modifier. Google's guide states its own form of this: an SPF record can have up to 10 include tags. Five senders, each with an include that itself contains includes, can exceed the limit quickly. Remove senders you no longer use. Because RFC 7489 lets DMARC pass on aligned DKIM alone, a sender that signs with DKIM for your domain does not strictly need an SPF include to pass DMARC, although Gmail and Yahoo still require bulk senders to have both SPF and DKIM.

Setting this up on SiteGround

SiteGround's email authentication tutorial says the settings are under Site Tools > Email > Authentication. SPF is enabled by default, and SiteGround reminds you that you can only have one SPF record; for SiteGround Email Marketing it says to merge include:_spf.emsnd.net into the existing record rather than create a second. If DKIM shows INACTIVE, Activate adds it to the DNS zone automatically when DNS is at SiteGround; if DNS is hosted elsewhere, copy the DKIM record and add it at your DNS provider.

SiteGround's DMARC article says a basic DMARC record is created automatically when the domain's DNS is managed with SiteGround, and advises starting with p=none and monitoring reports. The tutorial notes the rua reporting address is not pre-filled, so add one in the DNS Zone Editor, and allow up to 72 hours before checking DMARC. Google separately advises allowing 48 hours after setting up SPF and DKIM before setting up DMARC.

Setup checklist

• Inventory every service that sends mail with your domain in the From address.
• Keep exactly one SPF record; merge each sender's include into it and stay within 10 lookup terms.
• Enable DKIM for each sender, with 2048-bit keys where the DNS host supports them.
• Publish DMARC at p=none with a rua address, and read the reports for two to four weeks.
• Fix any legitimate sender that fails aligned SPF or DKIM before moving to quarantine or reject.
• Add one-click unsubscribe to marketing and subscribed mail; honor unsubscribes within 2 days for Yahoo.
• After any DNS or host move, confirm the DKIM and DMARC records still exist at the active DNS provider.

Sources & verification

Product details and prices can change. Check the linked provider before buying.

1. Google Workspace: set up SPF Accessed 30 Oct 2026
2. Google Workspace: set up DKIM Accessed 30 Oct 2026
3. Google Workspace: set up DMARC Accessed 30 Oct 2026
4. Gmail: email sender guidelines Accessed 30 Oct 2026
5. Yahoo Sender Hub: sender best practices Accessed 30 Oct 2026
6. RFC 7208: Sender Policy Framework Accessed 30 Oct 2026
7. RFC 7489: DMARC Accessed 30 Oct 2026
8. SiteGround: email authentication tutorial Accessed 30 Oct 2026
9. SiteGround: what is a DMARC record Accessed 30 Oct 2026