WP AlphaSee pricing
STAGING
Home / Knowledge base / Email

SPF, DKIM and DMARC for WordPress sites

SPF, DKIM and DMARC are three DNS records that prove email from your domain is genuine. Without all three, order emails, form notifications and newsletters from your WordPress site are increasingly rejected or sent to sp

The short answer

SPF, DKIM and DMARC are three DNS records that prove email from your domain is genuine. Without all three, order emails, form notifications and newsletters from your WordPress site are increasingly rejected or sent to spam. Set them up once, using the values your email sending service gives you, and start DMARC at a monitoring-only policy before tightening it.

What it means

Anyone can type your domain into the from field of an email. That is how scammers impersonate businesses, and it is why mailbox providers now ask every sender to prove they are allowed to use the domain. The proof lives in your DNS, the public directory for your domain that you control.

SPF (Sender Policy Framework) is a DNS record that lists which servers may send email for your domain. A receiver looks up the record and checks whether the server that delivered the message is on the list.

DKIM (DomainKeys Identified Mail) is a digital signature added to each outgoing message. The matching public key sits in your DNS, so a receiver can confirm the message was not altered and was signed by someone with access to your domain. When the signing domain matches the from address, the signature is “aligned”, and aligned DKIM is what fixes most spam placement.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that ties the two together. It tells receivers what to do when a message fails SPF and DKIM (nothing, quarantine it, or reject it) and where to send reports so you can see who is sending as your domain.

Gmail and Yahoo require all three from bulk senders, and in practice they reward every sender who has them. A WordPress site that sends through a plugin such as WP Mail SMTP or FluentSMTP can have all three in place in an afternoon.

Common causes

  • Records never set up. The domain has no SPF, DKIM or DMARC at all, usually because the site was set up years ago when nobody asked for them.
  • SPF does not include the actual sending service. The record lists the old mail server but not the SMTP or API service the WordPress plugin now sends through, so every site email fails SPF.
  • Two SPF records, or too many lookups. Only one SPF record is allowed per domain. Two records, or one that triggers more than 10 DNS lookups, make SPF fail entirely.
  • DKIM signed by the wrong domain. The sending service signs with its own domain instead of yours, so the signature is valid but not aligned with your from address, and DMARC fails.
  • DMARC set to reject before mail is passing. Jumping straight to p=reject while a legitimate sender is still misconfigured causes your own mail to be thrown away.

How to fix it

  1. List every service that sends as your domain. That usually means your mailbox provider (Google Workspace or Microsoft 365), the SMTP or API service your WordPress site uses, and any newsletter or invoicing tool. Each one needs to be covered by SPF and DKIM.
  2. Find where your DNS is managed. It will be at your domain registrar, at Cloudflare, or in your hosting control panel. In the management console (Plesk with WP Toolkit), open Websites & Domains, choose the domain, then DNS Settings. The records themselves are the same whichever host you use.
  3. Create one SPF record. Add a TXT record at the root of your domain combining the include values each service gave you, for example v=spf1 include:_spf.google.com include:servers.example-service.com -all. Delete any second SPF record. Use an online SPF checker to confirm it stays under the 10 lookup limit.
  4. Add DKIM for each service. Each service shows DKIM records in its settings (Google Workspace under Apps > Google Workspace > Gmail > Authenticate email; your SMTP service under its domain or sender settings). Add the CNAME or TXT records exactly as given, then press verify in the service. Check that the signing domain is yours.
  5. Add DMARC in monitoring mode. Create a TXT record at _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Reports will start arriving within a day or two; a free DMARC report viewer makes them readable.
  6. Make the WordPress site send correctly. Go to Plugins > Add New Plugin, install WP Mail SMTP or FluentSMTP, connect your sending service, and set the from address to your domain. Use the Email Test tab, send to a Gmail address, open Show original, and confirm SPF, DKIM and DMARC all PASS.
  7. Tighten DMARC over time. After a few weeks of clean reports, change p=none to p=quarantine. Once nothing legitimate is being quarantined, move to p=reject. Each step makes it harder for anyone to impersonate your domain.
  8. Revisit when anything changes. A new newsletter tool, a new form plugin or a new mailbox provider means a new SPF include and a new DKIM record.

On WP Alpha

These records live in DNS, so the work is the same whether or not WP Alpha hosts the site. If your domain’s DNS is managed in the management console (Plesk with WP Toolkit), the DNS Settings page under Websites & Domains is where you add the SPF, DKIM and DMARC records. If DNS is at your registrar or Cloudflare, add them there instead.

Support is available 24/7 by live chat, with tickets and an urgent escalation form. Support can check your records with you and VERIFY: whether support can review the outgoing mail log for your domain help trace a message that was refused.

In this category