To protect your domain with DMARC, SPF, and DKIM, you need to add TXT records to your domain’s DNS. The exact steps depend on where your DNS is hosted — your domain registrar or a third-party DNS provider like Cloudflare.
📋 What Records You Need
Email authentication uses three DNS TXT records. At minimum, you need SPF and DMARC. DKIM is typically configured through your email provider.
| Record | DNS Name | Type | Example Value |
|---|---|---|---|
| SPF | @ (root domain) |
TXT | v=spf1 include:_spf.google.com ~all |
| DKIM | selector._domainkey |
TXT | v=DKIM1; k=rsa; p=MIGf... |
| DMARC | _dmarc |
TXT | v=DMARC1; p=none; rua=mailto:... |
General Steps (All Providers)
Regardless of your DNS provider, the process follows the same pattern:
- Log in to your DNS provider’s control panel
- Find DNS management — usually called “DNS Records”, “Zone Editor”, “DNS Settings”, or “Advanced DNS”
- Add a new TXT record with the correct name and value
- Save and wait for propagation (usually 5 minutes to 48 hours)
- Verify using our Domain Checker tool
Where Is Your DNS Hosted?
Your DNS might not be at your domain registrar. Many people register a domain at GoDaddy or Namecheap but point the nameservers to Cloudflare or AWS. To find out where your DNS is hosted, check your domain’s nameservers — that’s the provider you need to make changes at.
Use our Domain Checker — it automatically detects your DNS provider and shows you which guide to follow.
Provider-Specific Guides
Select your DNS provider for step-by-step instructions on adding DMARC, SPF, and DKIM records:
☁️ Cloudflare
Free DNS with excellent performance. Most popular third-party DNS provider.
🌐 GoDaddy
World’s largest domain registrar. Default DNS for GoDaddy domains.
🏷️ Namecheap
Popular registrar with built-in DNS management and competitive pricing.
🔶 AWS Route 53
Amazon’s scalable DNS service. Common for businesses using AWS infrastructure.
🟦 Google Domains / Squarespace
Google Domains was acquired by Squarespace in 2023. DNS management now via Squarespace.
🔷 Azure DNS
Microsoft’s cloud DNS service. Common for organisations using Microsoft Azure.
The general steps above apply to all DNS providers. Look for “DNS Management”, “Zone Editor”, or “DNS Records” in your provider’s control panel. The record type is always TXT, and the values are the same regardless of provider.
Key Things to Know
Don’t wrap TXT record values in quotes when entering them in your DNS panel. Most providers add quotes automatically. Adding them yourself creates a broken record like
""v=DMARC1..."".
Some providers auto-append your domain to the record name. If your domain is
example.com, entering _dmarc.example.com could create _dmarc.example.com.example.com. Just enter _dmarc.
⏱️ DNS Propagation
After adding or changing DNS records, the changes need to propagate across the internet. This typically takes:
- Cloudflare: Near-instant (under 5 minutes)
- Most providers: 15 minutes to 1 hour
- Worst case: Up to 48 hours (rare)
Use our Domain Checker to verify your records are live.
Generate Your DMARC Record
Not sure what value to use for your DMARC record? Our DMARC Record Generator builds the perfect record for your domain — just enter your domain, choose your policy, and copy the result into your DNS provider.
- Use the DMARC Record Generator to create your record
- Follow the provider-specific guide above to add it to DNS
- Verify with the Domain Checker
- Read How to Implement DMARC for the full deployment strategy