---
title: "Using SPF, DKIM, and DMARC together"
description: "A practical order of operations and checks when enabling authentication for outbound mail."
translationKey: "email-spf-dkim-dmarc-together"
tags: [spf, dkim, dmarc]
publishedAt: "2026-05-01"
lastReviewedAt: "2026-05-01"
indexable: true
faq:
  - question: "What rollout order reduces authentication surprises?"
    answer: "Stabilize SPF for known senders, publish DKIM keys your provider supplies, then add DMARC in monitoring mode before tightening policy."
  - question: "Why enable DMARC in none before reject?"
    answer: "Aggregate reports reveal misconfigured streams and third-party senders so you do not block legitimate mail while tightening alignment rules."
---
> **Canonical:** https://formreceipt.com/docs/email-deliverability/spf-dkim-dmarc-together

## Recommended order

1. Fix SPF so legitimate sending IPs and includes are correct.
2. Enable DKIM signing with your provider and publish the TXT records they supply.
3. Publish DMARC in `p=none` while monitoring aggregate reports.
4. Tighten policy once legitimate streams authenticate cleanly.

## Documentation

Refer to your DNS host’s UI for TXT publishing—refer to [Cloudflare DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) as a generic example of creating TXT entries.