Email domain authentication

If your practice email is on your own domain (you@yourpractice.com), three domain name system (DNS) records tell Gmail, Outlook, and everyone else that mail from your domain is really from you: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Without them, your outreach and scheduling emails are far more likely to land in spam, and anyone can send email pretending to be you. Google and Yahoo have required them for bulk senders since 2024.

Add them wherever your domain's DNS is managed (Cloudflare, Squarespace Domains, GoDaddy, or Namecheap). The examples assume Google Workspace; Microsoft 365 works the same way with different values.

1. SPF: "who's allowed to send for my domain"

One TXT record at the root of your domain (host @):

v=spf1 include:_spf.google.com ~all

If other services send as your domain (a newsletter tool, or your electronic health record (EHR) system sending reminders from your address), add their include: too. Only one SPF record per domain: combine them into a single line.
~all (soft fail) is a safe start. Change to -all once you're sure the list is complete.

2. DKIM: "a signature proving it wasn't altered"

Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email.
Generate a new record (2048-bit).
Google shows a host name (usually google._domainkey) and a long TXT value. Add that TXT record in your DNS.
Wait 15 minutes to a few hours, then return to the Admin Console and click Start authentication.

3. DMARC: "what to do with mail that fails, and send me reports"

A TXT record at host _dmarc:

Start here (monitor only):

v=DMARC1; p=none; rua=mailto:you@yourpractice.com

After 2 to 4 weeks of clean reports, tighten:

v=DMARC1; p=quarantine; pct=100; rua=mailto:you@yourpractice.com

Eventually, if everything passes:

v=DMARC1; p=reject; rua=mailto:you@yourpractice.com

rua is where daily aggregate reports go, as zipped XML attachments from Google, Microsoft, and others. Skim them for anything failing that should pass, and route them to a separate address or a Gmail filter.
For a readable summary, search "DMARC report analyzer" for a free one.

4. Check your work

Send a message to a Gmail account, open it, ⋮ → Show original. You want SPF: PASS, DKIM: PASS, and DMARC: PASS.
Or use a free checker like MXToolbox (SPF, DKIM, and DMARC lookups).

Common mistakes

Two SPF records. Merge them into one.
Jumping straight to p=reject before confirming your EHR or newsletter tool is authorized. Its mail starts bouncing.
Forgetting third-party senders. An EHR that sends reminders "from" your domain needs to be in SPF, ideally with its own DKIM. Many EHRs send from their own domain, which avoids the issue.