SPF, DKIM and DMARC setup guide for Malaysian SMEs

Last reviewed: 8 November 2026

SPF, DKIM and DMARC are three DNS records that stop other people sending email that pretends to come from your domain. For a Malaysian SME this matters most for invoices and payment requests: if a scammer can send from [email protected], your customers have little reason to doubt them. Start by running our free email security check to see what you already have.

DNS records are your domain's public settings. They are kept by your DNS host, usually the company you bought the domain from, or a service such as Cloudflare. A TXT record is one type of DNS record that holds a line of text.

Three records, three jobsEach one is a short line of text in your domain's settings. Together they let mail providers spot fake email.

SPFLike a guest listNames the servers that are allowed to send email for your domain.
DKIMLike a tamper-proof sealAdds a signature to each email, so the receiver can tell it came from you and was not changed.
DMARCLike instructions to the guardTells mail providers what to do with email that fails the first two checks, and sends you reports.

What happens when your email arrivesYour customer's mail provider, for example Gmail, runs these checks in a split second.

An email arrivesIt says it is from [email protected].
SPF checkWas it sent by a server on your list?
DKIM checkIs your signature on it, and unchanged?
DMARC checkDid SPF or DKIM pass for the same domain the reader sees in the From line?

If it fails, your DMARC policy decides what happens:

p=noneDelivered as usual. You get a report.
p=quarantineSent to the spam folder.
p=rejectRefused. Your customer never sees it.

Email that passes is delivered normally. Matching the domain in the From line is what DMARC calls alignment.

Step 1: SPF, the list of allowed senders

SPF is a TXT record on your domain that lists the servers allowed to send your mail. Example for Google Workspace: v=spf1 include:_spf.google.com ~all. Rules from RFC 7208:

Publish exactly one SPF record. Two records break SPF.
Include every service that sends as your domain: email provider, invoicing or accounting system, newsletter tool, website contact form.
Stay within 10 DNS lookups. Each include, a and mx counts.

Use our SPF record generator to build one record. Provider values: Google Workspace, Microsoft 365, Zoho Mail.

Step 2: DKIM, a signature on every email

Your provider signs each outgoing email; you publish the public key in DNS so receivers can check the signature (RFC 6376). You turn it on in your provider's admin console: Google Workspace DKIM. Also turn on DKIM in any other service that sends as your domain.

Step 3: DMARC, your policy and your reports

DMARC is a TXT record at _dmarc.yourdomain. It tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports (RFC 7489). The rua= part is the email address that receives the reports.

A safe path to full protectionGo one step at a time, so a strict policy never blocks your own invoices.

1. WatchPublish v=DMARC1; p=none; rua=mailto:[email protected]. Nothing is blocked; reports start to arrive.
2. Fix your sendersRead the reports (a DMARC monitoring tool helps) and fix any real sender that fails.
3. QuarantineChange to p=quarantine. Fake email goes to spam.
4. RejectChange to p=reject. Fake email is refused.

Build your record with the DMARC record generator. Google and Yahoo require SPF, DKIM and DMARC for bulk senders: Google sender guidelines, Yahoo sender best practices.

Domains that never send email

Parked or brand-protection domains are easy to spoof. Lock them down with three records:

Record	Host	Value
MX (null MX, RFC 7505)	@	`0 .`
TXT (SPF)	@	`v=spf1 -all`
TXT (DMARC)	_dmarc	`v=DMARC1; p=reject`

Optional extras: MTA-STS and BIMI

MTA-STS asks other servers to use encrypted delivery to you (RFC 8461). BIMI shows your logo in some inboxes once DMARC is at quarantine or reject (BIMI Group).

FAQ

Do I need DMARC if I only send a few emails?

Yes. DMARC protects your domain from being used by others, which does not depend on how much you send.

Will p=reject stop my own email?

It can, if a real sender is not covered by SPF or DKIM. That is why you start with p=none and read the reports first.

How long do DNS changes take?

Usually minutes to a few hours, depending on the record's TTL and your DNS provider.