SPF, DKIM and DMARC Explained for Small Businesses (2026 Setup Guide)

By /

SPF, DKIM and DMARC Explained for Small Businesses (2026 Setup Guide)

If your business emails are landing in spam — or getting rejected outright — missing SPF, DKIM, and DMARC records are almost certainly the cause. This guide explains what each record does, why every small business needs all three, and exactly how to set them up.

Why Email Authentication Matters in 2026

Google and Microsoft now enforce strict email authentication checks on all incoming mail. Without SPF, DKIM, and DMARC in place, your invoices, proposals, and client replies go straight to junk — or bounce entirely.

The good news: these are free DNS records. You set them once and they work silently in the background forever.

What Is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists every mail server allowed to send email on behalf of your domain. When a receiving mail server gets a message claiming to be from yourcompany.com, it checks your SPF record to confirm the sending IP is on the approved list.

If it is not, the message is flagged as suspicious or rejected.

SPF Example

A typical SPF record looks like this:

v=spf1 include:mail.cmcloudhosting.com ~all
  • v=spf1 — declares this as an SPF record
  • include: — approves a third-party mail server
  • ~all — soft-fail anything not on the list (recommended over -all for new setups)

One SPF record per domain. If you have multiple sending services (transactional email + newsletter tool), combine them into a single record with multiple include: statements.

What Is DKIM?

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outbound message. The receiving server uses a public key published in your DNS to verify the signature, confirming the message was not tampered with in transit.

Think of it as a wax seal on an envelope — if the seal is broken, the recipient knows something changed.

How DKIM Works

  1. Your mail server signs each message with a private key it holds securely.
  2. The matching public key sits in a DNS TXT record at a selector address like mail._domainkey.yourcompany.com.
  3. Receiving servers check the signature automatically — no action needed from the sender or recipient.

CM Cloud Business Email generates your DKIM keys automatically and provides the exact DNS record to add. You copy, paste, and you are done.

What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that sits on top of SPF and DKIM. It tells receiving mail servers what to do when a message fails authentication — and it sends you reports so you can see what is happening.

DMARC Policy Options

Policy What Happens on Failure
p=none Deliver anyway, send report (monitoring mode — start here)
p=quarantine Move to spam folder
p=reject Block the message entirely

A safe starting record for a new setup:

v=DMARC1; p=none; rua=mailto:[email protected]

After a week of reviewing reports and confirming legitimate mail passes, move to p=quarantine, then p=reject.

SPF, DKIM and DMARC: How They Work Together

These three records solve different parts of the same problem:

  • SPF proves which server sent the message
  • DKIM proves the message content was not altered
  • DMARC ties both together and defines the policy on failure

You need all three. SPF alone can be spoofed. DKIM alone does not prevent a rogue server from sending. DMARC without SPF and DKIM has nothing to enforce.

Step-by-Step: Setting Up SPF, DKIM and DMARC

Step 1 — Subscribe to Business Email Hosting

Business email is not included in web hosting plans. You need a separate CM Cloud Business Email subscription to get a professional mailbox at your domain. Plans start at $1.99/user/month (XAF 1,250 / €1.85).

Once your mailbox is active, CM Cloud provides all three DNS records pre-generated in your control panel.

Step 2 — Add Your SPF Record

  1. Go to your domain’s DNS manager.
  2. Create a TXT record on your root domain (@).
  3. Paste the SPF value provided by CM Cloud.
  4. Save. Propagation takes up to 24 hours but is usually minutes.

Step 3 — Add Your DKIM Record

  1. In your CM Cloud email panel, copy the DKIM TXT record (it looks like mail._domainkey).
  2. Create a new TXT record in DNS with that exact hostname and value.
  3. Save.

Step 4 — Add Your DMARC Record

  1. Create a TXT record at _dmarc.yourcompany.com.
  2. Start with v=DMARC1; p=none; rua=mailto:[email protected].
  3. After reviewing reports for 7–14 days, tighten to p=quarantine or p=reject.

Step 5 — Verify Everything

Use a free tool like MXToolbox or mail-tester.com to confirm all three records are live and passing. Send a test message and check the authentication headers.

What About Email Signatures?

Once authentication is in place, you can add company-wide HTML email signatures without breaking DKIM. CM Cloud’s Email Signatures add-on ($0.99/mo per domain — not per user) stamps a consistent signature onto every outbound message at the server level, covering every device and mail client automatically.

Because signatures are applied before DKIM signing, mail still authenticates correctly and does not land in spam. This is a common failure point with competitor tools that insert signatures after signing.

See the full breakdown of per-domain vs per-user signature pricing here.

Business Email Pricing Comparison

Provider Per Mailbox/mo (USD) XAF EUR DKIM/DMARC Support
CM Cloud $1.99 XAF 1,250 €1.85 ✅ Auto-generated records
Google Workspace $7.20 ~XAF 4,500 ~€6.70 ✅ Manual setup
Microsoft 365 Business Basic $6.00 ~XAF 3,750 ~€5.60 ✅ Manual setup
Zoho Mail Lite $1.00 ~XAF 625 ~€0.93 ✅ Manual setup

CM Cloud pre-generates your SPF, DKIM, and DMARC records and shows them directly in the portal — no hunting through documentation.

Common SPF, DKIM and DMARC Mistakes to Avoid

  • Multiple SPF records — you can only have one. Combine everything into a single TXT record.
  • Forgetting transactional email — if you use Mailchimp, SendGrid, or a booking tool to send email from your domain, add their include: to your SPF record.
  • Staying on p=none forever — monitoring mode is a starting point, not a destination. Move to p=reject once you have confirmed your legitimate mail is passing.
  • DKIM key rotation — change your DKIM keys periodically (every 6–12 months) for better security.
  • Applying signatures after DKIM signing — always stamp signatures at the server before signing, or use a tool like CM Cloud Email Signatures that handles this correctly.

CM Cloud Business Email: What You Get

  • Professional mailbox at your domain from $1.99/user/mo (XAF 1,250 / €1.85)
  • Bundle of 5 mailboxes for $4.99/mo (XAF 3,000 / €4.60)
  • Auto-generated SPF, DKIM, and DMARC records in the portal
  • IMAP and SMTP access from any mail client
  • Optional Email Signatures add-on at $0.99/mo per domain (flat — not per user)
  • Sold separately from web hosting — see full pricing at cmcloudhosting.com/pricing

Get Your Business Email Authenticated Today

SPF, DKIM, and DMARC are not optional in 2026 — they are the baseline for deliverability. Every email you send without them is a coin flip on whether it reaches the inbox.

CM Cloud Business Email gives you pre-built authentication records, a professional mailbox from $1.99/user/month, and the optional Email Signatures add-on at a flat per-domain rate that scales to any team size.

Set up Business Email with CM Cloud →

Scroll to Top