S
Set up SPF, DKIM, DMARC, and BIMI to prove your emails are legitimate and protect your domain from spoofing.
List every platform (ESP, CRM, transactional service, helpdesk) that uses your domain in the From or Return-Path. Missing even one causes SPF failures.
Add a TXT record starting with "v=spf1" that includes each sending service. End with "-all" (hard fail) or "~all" (soft fail). Stay under 10 DNS lookups.
Use an SPF checker to confirm the record parses correctly, has no syntax errors, and stays within the 10 DNS lookup limit.
Each subdomain needs its own SPF record. If a subdomain does not send email, publish "v=spf1 -all" to block spoofing.