NexlyFlowVerify SPF, DKIM and DMARC
12 steps · About 20 minutes, plus DNS waiting time
What you will finish with. All three domain checks green in NexlyFlow, the single biggest factor in whether your emails reach the inbox instead of the spam folder.
Who this is for. Anyone sending from their own domain – do this before your first real campaign.
Before you start: finish SMTP setup first, and make sure you can log in wherever your domain DNS is managed.
SPF lists which servers may send email using your domain. Without it, anyone can pretend to be you, so receiving servers distrust your mail.
DKIM adds an invisible signature to every message. The receiver checks it against your DNS to confirm the message really came from you and was not altered.
DMARC tells receivers what to do when SPF or DKIM fails, and asks them to report it to you.
1Confirm which domain you send from
Look at the From email you saved in Sending Setup. The part after the @ is the domain you must verify. If you send from more than one domain, repeat this guide for each.
Why this matters. Records added to the wrong domain do nothing at all – the most common wasted hour in email setup.
Expected result. You have the exact domain written down, without www and without the @.
If it fails. If your From email uses a subdomain, that subdomain is what you verify.
2Open your DNS management page
Log in to whoever manages your domain – usually the registrar you bought it from, or your hosting provider. Find the section called DNS, DNS Zone, Name servers or Advanced DNS.
Where is my DNS page?
DNS lives wherever you BOUGHT the domain (or wherever its name servers point). Click your company for the exact clicks.
Not sure who holds your domain? Search for a WHOIS lookup and enter your domain – the registrar name is shown there.
How to know you are in the right place
You are on the correct page when you can see a list of existing records with a column called Type showing letters like A, MX, TXT or CNAME, and a button that says Add, Add record or Add New Record.
If instead you see prices, renewal dates or a shopping cart, you are still in the billing area – look for the words DNS, Manage DNS, DNS Zone or Advanced DNS.
The three fields have different names at different companies, but they always mean the same thing:
Why this matters. This is the only place the internet reads your domain settings from; NexlyFlow cannot change them for you.
Expected result. You can see a list of existing records with types like A, MX, TXT and CNAME.
If it fails. If your domain uses third-party name servers, records must be added there, not at the registrar.
3Get the records from NexlyFlow
In the app open Sending Setup and click Check domain. The result panel lists SPF, DKIM and DMARC with their current status and what still needs to be added.
Why this matters. The values are generated for your account and mailbox – copying values from a blog post or another company will always fail.
Expected result. You can see which of the three are missing or failing.
If it fails. If the panel shows nothing, save your SMTP settings first – the check needs to know your sending domain.
4Add the SPF record
Add a TXT record for your domain root. Paste the value exactly as NexlyFlow shows it, with no extra spaces or quotes.
What exactly goes in the SPF value?
SPF lists who may send email using your domain, so it must include whoever hosts your mailbox. Pick the line that matches your provider:
v=spf1 include:_spf.google.com ~allv=spf1 include:spf.protection.outlook.com ~allv=spf1 include:zoho.com ~allv=spf1 include:spf.mail.yahoo.com ~allv=spf1 include:secureserver.net ~allv=spf1 include:_spf.mail.hostinger.com ~allAlready have an SPF record? Do not add a second one. Merge them: keep one v=spf1 at the start, list every include one after another, and finish with ~all. Example of a merged record: v=spf1 include:_spf.google.com include:_spf.mail.hostinger.com ~all
Your own provider may publish a slightly different include – if NexlyFlow shows you a value in Check domain, that value wins over this table.
Why this matters. SPF authorises your sending server. Without it most receivers treat your mail as suspicious no matter how good the content is.
Expected result. The record appears in your DNS list.
If it fails. Never create a SECOND SPF record – a domain may have only one. If one exists, merge the new part into it.
5Add the DKIM record
Add the DKIM record exactly as shown – the name usually looks like a selector followed by _domainkey. Copy the whole value; DKIM values are long and are often truncated by accident.
Why this matters. DKIM proves the message was not tampered with. It is the record that most often fails because only half the value was pasted.
Expected result. The record appears with the full value intact.
If it fails. If your DNS panel adds quotes automatically, do not add your own. If the saved value looks shorter than what NexlyFlow shows, paste it again.
6Add the DMARC record
Add a TXT record named _dmarc. Start with a monitoring-only policy so nothing is rejected while you confirm everything works, and include an address for reports.
A safe DMARC record you can copy
Create a TXT record named _dmarc and paste this as the value. Replace the address with your own before saving.
v=DMARC1; p=none; rua=mailto:you@yourcompany.comWhat it means in plain words: p=none tells receiving mail servers “just watch and report, do not block anything yet”. That is the safe starting point. Weeks later, once reports look clean, you can tighten it to quarantine.
Why this matters. DMARC turns SPF and DKIM into an enforceable policy and gives you visibility. Starting at p=none means you learn without risking legitimate mail.
Expected result. The _dmarc record appears in your DNS list.
If it fails. Only one DMARC record per domain. Tighten the policy weeks later, after clean reports – never on day one.
7Save your DNS changes
Click save or apply in your DNS panel. Some providers need an extra confirmation before records go live.
Why this matters. Unsaved records are invisible to the internet, producing a confusing “nothing changed” result later.
Expected result. Each new record is visible in the record list after a refresh.
If it fails. If the panel rejects a value, check for a stray space at the start or end of what you pasted.
8Wait for DNS to spread
DNS changes are copied between servers worldwide on a schedule. Allow at least 15-30 minutes; some providers take up to 24-48 hours.
Why this matters. Checking too early gives a red result that is not a real failure – which leads people to change correct records and break them.
Expected result. Time passes. This step is deliberately doing nothing.
If it fails. If you are impatient, re-check every 15 minutes rather than editing records repeatedly.
9Return to NexlyFlow and re-check
Open Sending Setup and click Check domain again.
Why this matters. This reads live DNS, so it reflects exactly what receiving mail servers see.
Expected result. SPF, DKIM and DMARC each show a passing status and your domain score rises.
If it fails. A single red item does not block sending, but each one lowers inbox placement – fix it before volume sending.
10Read the result line by line
Look at each of the three lines separately. A failure on one record tells you exactly which record to revisit – you do not need to redo the whole guide.
Why this matters. Treating the result as one pass-or-fail hides which record is wrong and costs another DNS wait cycle.
Expected result. You know precisely which record, if any, still needs work.
If it fails. If the panel still shows an old result, refresh the page – the check runs when you click it.
11Fix a failing record
SPF failing usually means a duplicate SPF record. DKIM failing usually means a truncated value. DMARC failing usually means the record is not named _dmarc. Fix, save, wait, re-check.
The five mistakes that cause almost every failure
Why this matters. Each record fails for its own characteristic reason, so targeted fixes are much faster than starting over.
Expected result. After the next DNS wait, the failing line turns green.
If it fails. Still failing after 48 hours? Send us the exact wording in the panel and we will read it with you.
12Protect your domain going forward
Keep using your verified sending domain for outreach and avoid sudden volume jumps from a brand-new mailbox. Start small and increase gradually week by week.
Why this matters. Domain reputation is earned slowly and lost quickly; one aggressive first week can undo a perfect DNS setup.
Expected result. Your checks stay green and inbox placement holds as volume grows.
If it fails. If results drop, reduce daily volume, send only to engaged contacts, and let reputation recover before scaling again.
Send us a screenshot of your Check domain panel and your DNS record list. Contact support.
SPF and DKIM values by provider (verified 2026-08)
SPF value:
v=spf1 include:_spf.google.com ~allDKIM: admin.google.com → Apps → Google Workspace → Gmail → Authenticate email → choose the domain → GENERATE NEW RECORD (2048-bit, prefix google) → publish the TXT it shows at Name
google._domainkey → back on that page click START AUTHENTICATION.SPF value:
v=spf1 include:spf.protection.outlook.com ~allDKIM: security.microsoft.com → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM → click the domain → switch Sign messages ON. It refuses the first time and shows TWO CNAME records (selector1._domainkey and selector2._domainkey) — publish both, then switch ON again.
SPF value:
v=spf1 include:secureserver.net ~allDKIM: godaddy.com → My Products → Email & Office → Manage → your domain. If GoDaddy also hosts your DNS it publishes DKIM for you. If your DNS is elsewhere, enable DKIM at security.microsoft.com instead and publish the two CNAMEs yourself.
SPF value:
v=spf1 include:zoho.com ~allDKIM: mailadmin.zoho.com (or zoho.eu / zoho.com.cn for your region) → Domains → your domain → Email Configuration → DKIM → Add selector (name it zoho) → publish the TXT at Name
zoho._domainkey → press Verify.SPF value:
v=spf1 include:spf.mail.qq.com ~allDKIM: exmail.qq.com admin console (or work.weixin.qq.com if your mail moved to WeCom) → old console: 工具箱 / 域名管理 → DKIM; WeCom console: 协作 → 邮件 → 设置 → DKIM验证 → 配置. Publish the TXT it shows, then click 已完成配置，立即验证.
SPF value:
v=spf1 include:spf.mxhichina.com ~allDKIM: Mail admin console → 域名管理 → your domain → 域名设置 → DKIM → 生成密钥 (2048) → publish 主机记录 + 记录值 as TXT → verify. Newer accounts use
include:spf.qiye.aliyun.com — always trust the value your own console shows.SPF value:
v=spf1 include:spf.163.com ~allDKIM: qiye.163.com admin console (free edition: ym.163.com) → 域名管理 → your domain → DKIM / 安全设置 → generate → publish the TXT it shows → verify.
SPF value:
v=spf1 a mx ~allDKIM: cPanel / hPanel → Email Deliverability → your domain → MANAGE (or Repair). If DNS is at the same company press INSTALL THE SUGGESTED RECORD and it publishes SPF and DKIM for you; otherwise copy the DKIM record shown (usually
default._domainkey) to wherever your DNS lives.TXT · Name _dmarc · Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com