FAQ: Configure SPF, DKIM, and DMARC for email deliverability

Before You Begin: 

You will need to ADD these DKIM and DMARC records to your DNS records, you WILL NOT need to delete your existing DKIM and DMARC record. If you delete your existing DKIM and DMARC records it will reduce deliverability; adding records does not impact email deliverability. 

 For more information, please watch this demo before you begin. 

Why SPF, DKIM, and DMARC matter

Mailbox providers like Gmail, Outlook, and Yahoo need to know whether messages using your domain are truly from you. Three DNS records (SPF, DKIM, and DMARC) work together to prove authenticity. Gmail, Yahoo, Microsoft, Apple, and many others now require full SPF, DKIM, and DMARC authentication for bulk senders.

• SPF (Sender Policy Framework): Says which servers are allowed to send on behalf of your domain.

• DKIM (DomainKeys Identified Mail): Attaches a digital signature to each outgoing message that mailbox providers can check against your DNS.

• DMARC (Domain-based Message Authentication, Reporting & Conformance): Tells mailbox providers how to treat mail that fails SPF/DKIM, and sends you reports on who’s using your domain.

Configured together, they:

• Protect your domain reputation (the biggest factor in inbox placement).

• Reduce the risk of phishing and spoofing using your domain.

• Improve trust with mailbox providers and supporters.

Where to add your records

You’ll configure these records with your DNS host (the same place where you manage your website domain). Common hosts include GoDaddy, Cloudflare, and Squarespace.

• If you’re unsure who manages your domain, you can look it up at whois.com

• Your domain administrator (often IT staff or your website manager) will need to add or update these records.

• Our support team cannot directly change DNS on your behalf.

Watch a video about configuring SPF/DKIM for deliverability

Step 1: Configure SPF

1. Locate your existing SPF record (a TXT record beginning with v=spf1).

2. Add our include statement (include:_spfprod.ngpvan.com) before the ~all.

If no TXT record exists with a starting value of “v=spf1,” create a new TXT record with the following information:

Host Value: @

TXT Value: v=spf1 include:_spfprod.ngpvan.com ~all

Important: You should only have one SPF record per domain. Combine all services into a single record. Be sure to stay under the 10-lookup limit, which you can validate with Dmarcian’s SPF Surveyor: SPF Surveyor - dmarcian

Step 2: Configure DKIM

1. Create the following two CNAME records in your DNS:

Some DNS hosts (like GoDaddy) automatically add your domain name to the Host/Name field. For example, if your domain is example.org, you may only need to enter ea1._domainkey and ea2._domainkey, not the full ea1._domainkey.example.org.

If you use Cloudflare, make sure these records are set to DNS only, not proxied.

Note: If you previously configured a DKIM TXT record with a different selector, such as ngpweb3, it will continue to work, but we encourage you to switch to these records.

Step 3: Configure DMARC

DMARC builds on SPF and DKIM by telling mailbox providers what to do if a message fails authentication.

1. Create a new TXT record with host value:

   _dmarc.yourdomain.org

2. Start with a monitoring policy. Here is an example record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.org; ruf=mailto:dmarc-reports@yourdomain.org; fo=1

• p=none = monitor only, don’t block mail yet.

• rua = aggregate report address (create an inbox to receive these or sign up for a third-party DMARC monitoring service).

• ruf = forensic report address (optional, can be noisy).

• fo=1 = request detailed failure reports.

3. As your domain passes consistently, you can move toward stronger enforcement:

   • p=quarantine (send failures to spam).

   • p=reject (block failures outright).

Best practice: Start with p=none, monitor for a month, then move to quarantine or reject when you’re confident legitimate mail is passing. This will help protect your campaign from malicious actors.

A note on DMARC alignment

DMARC checks whether your domain aligns with either SPF or DKIM.

• Bulk email (Targeted Email): By default, mail is DKIM-signed with your domain, so you have DKIM alignment. The envelope-from is bounce.myngp.com, so SPF does not normally align. For the vast majority of senders, DKIM alignment is all that’s needed.

• Transactional email (Online Actions): For transactional mail, the envelope-from uses your domain directly, so SPF matters. If you send transactional messages, be sure your SPF record is set up correctly.

• Enterprise considerations: Some enterprise systems enforce stricter alignment or may rewrite DKIM headers. If a large portion of your audience is made up of enterprise domains, SPF alignment can help.

• Next step: Contact Support if you need a custom return-path domain for SPF alignment in Targeted Email.

Step 4: Validate your setup

• Use the Targeted Email settings page to validate your setup. Be sure to follow the prompts to register your domain as well.

Key takeaways

• SPF, DKIM, and DMARC are essential for protecting your domain and reputation.

• Publish one SPF record, add DKIM, and start DMARC in monitor mode.

• Validate regularly and move toward DMARC enforcement once you’re confident in your setup.

• Strong authentication improves inbox placement, protects your supporters, and strengthens trust in your organization.