How to set up SPF, DKIM, and DMARC for your domain

If you're connecting your own domain to Caide (rather than using a Caide Managed Mailbox), you'll need to set up three DNS records: SPF, DKIM, and DMARC. Don't let the acronyms scare you. This is a one-time setup that takes about five minutes, and once it's done, you don't need to touch it again.

Skip this and your emails will land in spam. Do this right and you're golden.

What are these records, exactly?

Think of them as three little ID badges your emails carry when they leave your mailbox:

• SPF tells receiving servers "this domain is allowed to send emails from these places." Without it, your emails look like they're coming from a stranger.
• DKIM adds a cryptographic signature to every email you send. It proves the message is actually from you and wasn't tampered with in transit.
• DMARC ties the two together and tells email providers what to do if something looks off. It's what keeps spoofers from sending emails pretending to be you.

All three records live in your DNS settings wherever you manage your domain. That's usually Cloudflare, GoDaddy, Namecheap, Squarespace, or similar.

Step 1: Add your SPF record

Go to your DNS provider and add a new TXT record. When it asks you to fill in fields, use these:‍

• Host / Name: @ (this just means your root domain)
• Value / Content: v=spf1 include:_spf.google.com ~all
• TTL: Leave it as the default

If you're on Google Workspace, that value is exactly right.
[[callout]]Using a different email provider? They'll have their own include value in their docs. Swap out _spf.google.com for whatever they specify.[[callout end]]

Step 2: Add your DKIM record

DKIM is slightly different. Your email provider generates this one for you, so you don't write it yourself.

Head to your email provider's settings (Google Workspace, Outlook, or wherever your mailbox lives), find the DKIM section, and generate a record. They'll give you a TXT record with a hostname that looks something like:

google._domainkey.yourdomain.com

Copy that record into your DNS settings exactly as-is. It's important not to modify the value.

Here are few few quick links for popular providers to help guide you on generating they key pair:

Google workspace
Outlook
‍Amazon SES

Step 3: Add your DMARC record

Create a new TXT record at _dmarc.yourdomain.com with this value:

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

Replace you@yourdomain.com with an email address where you'd like to receive delivery reports. These are automated summaries; you don't need to read them obsessively, but it's good to have them somewhere.

p=none means DMARC is in monitoring mode: it watches, but won't block anything. That's fine for most Caide users. It's the safe, sensible default.

How do I know it's working?

DNS changes usually take a few minutes to propagate, but can take up to 48 hours in rare cases. Once they're live, you can verify everything is set up correctly using a free tool like MXToolbox. Just enter your domain and check SPF, DKIM, and DMARC.

If all three come back green, you're good to go.

[[callout]]Heads up: If you'd rather skip all of this entirely, Caide Managed Mailboxes handle DNS setup automatically. No records to configure, no propagation to wait for.

‍

Learn more about CMMs →[[callout end]]

FAQ

Do I need to do this if I'm using a Caide Managed Mailbox?

‍Nope. CMMs handle all DNS configuration for you. This guide is only for users connecting their own Google or Outlook inbox.

I already have an SPF record. What do I do?

‍Edit your existing SPF record and add the new include: to it. Don't create a second one — having two SPF records breaks authentication entirely.

Does it matter which DNS provider I use?

‍Not really. The process is the same regardless of whether you're on Cloudflare, GoDaddy, Namecheap, or anywhere else. The interface will look different, but you're always creating TXT records in the same way.

Something's not working. Help?

‍Drop us a message. DNS is one of those things that looks simple but has a thousand ways to go slightly wrong. We're always happy to take a look.

‍