To protect your domain with DMARC, SPF, and DKIM, you need to add a few settings to your domain’s public directory (DNS). These are text-based entries called TXT records. The exact steps depend on where your domain’s settings are managed — usually your domain registrar or a service like Cloudflare.
📋 What Records You Need
Email protection uses three settings in your domain’s public directory (DNS TXT records). At minimum, you need SPF and DMARC. DKIM is typically set up through your email provider.
| What It Does | Where to Add It | Record Type | Example Value |
|---|---|---|---|
| SPF | @ (root domain) |
TXT | v=spf1 include:_spf.google.com ~all |
| DKIM | selector._domainkey |
TXT | v=DKIM1; k=rsa; p=MIGf... |
| DMARC | _dmarc |
TXT | v=DMARC1; p=none; rua=mailto:... |
General Steps (All Providers)
Regardless of where your domain’s settings are managed, the process follows the same pattern:
- Log in to your domain’s settings provider (DNS host)
- Find DNS management — usually called “DNS Records”, “Zone Editor”, “DNS Settings”, or “Advanced DNS”
- Add a new TXT record with the correct name and value
- Save and wait for the changes to spread across the internet (usually 5 minutes to 48 hours)
- Verify using our Domain Checker tool
Where Are Your Domain’s Settings Managed?
Your domain’s settings (DNS) might not be managed by the company you bought the domain from. Many people register a domain at GoDaddy or Namecheap but use a service like Cloudflare or AWS to manage the actual settings. To find out where your DNS is managed, check your domain’s nameservers — that tells you which provider you need to make changes at.
Use our Domain Checker — it automatically detects where your domain’s settings are managed and shows you the right guide to follow.
Provider-Specific Guides
Select where your domain’s settings are managed for step-by-step instructions on adding DMARC, SPF, and DKIM records:
☁️ Cloudflare
Free DNS with excellent performance. Most popular third-party settings provider.
🌐 GoDaddy
World’s largest domain registrar. Default DNS for GoDaddy domains.
🏷️ Namecheap
Popular registrar with built-in DNS management and competitive pricing.
🔶 AWS Route 53
Amazon’s scalable DNS service. Common for businesses using AWS cloud hosting.
🟦 Google Domains / Squarespace
Google Domains was acquired by Squarespace in 2023. DNS management now via Squarespace.
🔷 Azure DNS
Microsoft’s cloud DNS service. Common for organisations using Microsoft Azure.
The general steps above apply to all DNS providers. Look for “DNS Management”, “Zone Editor”, or “DNS Records” in your provider’s control panel. The record type is always TXT, and the values are the same regardless of where your settings are managed.
Key Things to Know
Don’t wrap TXT record values in quotes when entering them in your DNS panel. Most providers add quotes automatically. Adding them yourself creates a broken record like
""v=DMARC1..."".
Some providers auto-append your domain to the record name. If your domain is
example.com, entering _dmarc.example.com could create _dmarc.example.com.example.com. Just enter _dmarc.
⏱️ How Long Do Changes Take?
After adding or changing these records, the changes need to spread across the internet (called DNS propagation). This typically takes:
- Cloudflare: Near-instant (under 5 minutes)
- Most providers: 15 minutes to 1 hour
- Worst case: Up to 48 hours (rare)
Use our Domain Checker to verify your records are live.
Generate Your DMARC Record
Not sure what value to use for your DMARC record? Our DMARC Record Generator builds the perfect record for your domain — just enter your domain, choose your policy, and copy the result into your DNS provider.
- Use the DMARC Record Generator to create your record
- Follow the provider-specific guide above to add it to DNS
- Verify with the Domain Checker
- Read How to Implement DMARC for the full deployment strategy