Find New Customer
Deliverability

Set up SPF, DKIM and DMARC

Not required to use Find New Customer, but worth getting right: the three records that tell email providers your messages are genuinely from you.

Find New Customer needs no extra setup

Nothing on this page is required in order to use Find New Customer. Your campaigns are submitted through your own Google or Microsoft mailbox, as you, so they are signed and sent by your provider exactly as your normal email is. We add no new sending server, no shared domain and no relay — so if you can already send email from that mailbox, you can already send campaigns. This page is here because getting these records right improves delivery for all of your email, ours included.

These three records are how a receiving mail server checks that a message claiming to come from your domain really did. Without them, commercial email from your domain is far more likely to be filtered — and with DMARC increasingly expected by major providers, missing records are now a practical problem rather than a theoretical one.

SPF — who is allowed to send as you

An SPF record lists the servers permitted to send email for your domain. Because you send through your own Google or Microsoft mailbox, you authorise that provider.

Google Workspace

v=spf1 include:_spf.google.com ~all

Microsoft 365

v=spf1 include:spf.protection.outlook.com -all

Only one SPF record per domain

A domain must have exactly one SPF TXT record. If you already have one, add the include to the existing record rather than creating a second — two SPF records is a configuration error and causes checks to fail.

DKIM — a signature on every message

DKIM adds a cryptographic signature that proves the message was not altered in transit and really came from your domain. Both providers generate the key for you.

  1. Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate the key, publish the TXT record it gives you, then start authentication.
  2. Microsoft 365: Defender portal → Policies → Email authentication settings → DKIM. Select your domain, publish the two CNAME records it shows, then enable signing.
  3. Allow time for DNS to propagate before enabling — usually minutes, occasionally hours.

DMARC — what to do when a check fails

DMARC tells receiving servers how to treat mail that fails SPF and DKIM, and asks them to send you reports. Start in monitoring mode, read the reports, and only tighten once you are confident nothing legitimate is failing.

Start here

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

Then, once reports are clean

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com"

Checking your work

  • Send yourself a test from your connected mailbox and inspect the message headers for spf=pass, dkim=pass and dmarc=pass.
  • Your provider’s admin console reports authentication status for your domain.
  • DMARC aggregate reports will arrive at the address in your rua tag within a day or two.