SPF, DKIM and DMARC setup guide for Malaysian SMEs

Last reviewed: 8 November 2026

SPF, DKIM and DMARC are three DNS records that stop other people sending email that pretends to come from your domain. For a Malaysian SME this matters most for invoices and payment requests: if a scammer can send from accounts@yourcompany.com.my, your customers have little reason to doubt them. Start by running our free email security check to see what you already have.

Step 1: SPF, the list of allowed senders

SPF is a TXT record on your domain that lists the servers allowed to send your mail. Example for Google Workspace: v=spf1 include:_spf.google.com ~all. Rules from RFC 7208:

Publish exactly one SPF record. Two records break SPF.
Include every service that sends as your domain: email provider, invoicing or accounting system, newsletter tool, website contact form.
Stay within 10 DNS lookups. Each include, a and mx counts.

Use our SPF record generator to build one record. Provider values: Google Workspace, Microsoft 365, Zoho Mail.

Step 2: DKIM, a signature on every email

Your provider signs each outgoing email; you publish the public key in DNS so receivers can check the signature (RFC 6376). You turn it on in your provider's admin console: Google Workspace DKIM. Also turn on DKIM in any other service that sends as your domain.

Step 3: DMARC, your policy and your reports

DMARC is a TXT record at _dmarc.yourdomain. It tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports (RFC 7489). A safe path:

Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.my to collect reports.
Read the reports (a DMARC monitoring tool helps) and fix any real sender that fails.
Move to p=quarantine, then p=reject.

Build your record with the DMARC record generator. Google and Yahoo require SPF, DKIM and DMARC for bulk senders: Google sender guidelines, Yahoo sender best practices.

Domains that never send email

Parked or brand-protection domains are easy to spoof. Lock them down with three records:

Record	Host	Value
MX (null MX, RFC 7505)	@	`0 .`
TXT (SPF)	@	`v=spf1 -all`
TXT (DMARC)	_dmarc	`v=DMARC1; p=reject`

Optional extras: MTA-STS and BIMI

MTA-STS asks other servers to use encrypted delivery to you (RFC 8461). BIMI shows your logo in some inboxes once DMARC is at quarantine or reject (BIMI Group).

FAQ

Do I need DMARC if I only send a few emails?

Yes. DMARC protects your domain from being used by others, which does not depend on how much you send.

Will p=reject stop my own email?

It can, if a real sender is not covered by SPF or DKIM. That is why you start with p=none and read the reports first.

How long do DNS changes take?

Usually minutes to a few hours, depending on the record's TTL and your DNS provider.