Skip to content
OrbixPanel OrbixPanel Tutorials

Set up DKIM, SPF, and DMARC for your email

If your email lands in spam — or bounces — it’s almost always because these three DNS records aren’t set up. Together they prove your mail is really from you.

What each one does

  • SPF — a TXT record listing which servers are allowed to send mail for your domain. Stops others from forging your address.
  • DKIM — a cryptographic signature on every message. The matching public key lives in a DNS record; receivers verify the signature.
  • DMARC — tells receivers what to do if SPF/DKIM fail, and where to send reports.

DKIM

OrbixPanel sets up DKIM signing for your mail domain (via OpenDKIM) with a selector and a key pair. The public key goes in a TXT record at:

<selector>._domainkey.yourdomain.com   TXT   "v=DKIM1; k=rsa; p=<public key>"

Because OrbixPanel can host your DNS, it can publish this record for you — just confirm it’s present in your zone.

SPF

Add one TXT record at your domain root authorizing your server to send:

yourdomain.com   TXT   "v=spf1 a mx ip4:YOUR.SERVER.IP -all"

-all means “reject anything not listed.” Use ~all (softfail) while testing, then tighten to -all.

DMARC

Add a TXT record at _dmarc.yourdomain.com. Start gentle, then enforce:

_dmarc.yourdomain.com   TXT   "v=DMARC1; p=none; rua=mailto:postmaster@yourdomain.com"
  • p=none — monitor only (start here, read the reports).
  • p=quarantine → p=reject — enforce once you’re confident SPF+DKIM pass.

Verify

Send a test to a Gmail account, open Show original, and confirm SPF: PASS, DKIM: PASS, DMARC: PASS. Or use a mail-tester tool for a full score.

Next: Fix emails going to spam.

Running OrbixPanel? DKIM signing is configured for you, with self-hosted DNS to publish the records. OrbixPanel.com → — the free, self-hosted, AI-powered hosting control panel.