How to Set Up Email for a New Domain (MX, SPF, DKIM, DMARC)

To set up email for a new domain, sign up with a provider such as Google Workspace or Microsoft 365, verify the domain with a TXT record, create mailboxes, then add the provider's MX record so mail reaches it. Finish with SPF, DKIM signing and a DMARC record so your messages are trusted and harder to spoof.

Below is the full sequence for both providers, with the exact records to add, the order to add them in, and how to check everything works.

AI Automation for HVAC, Plumbing and Electrical Firms, Explained Step by Step · 3:03 Subscribe

What do I need before I start?

• The domain itself, registered with an accredited registrar (for a .uk domain, a Nominet-accredited one).
• Access to the DNS settings, usually at your registrar, or at Cloudflare or your web host if DNS lives there. Check which company your domain's nameservers point to.
• A mail provider account. Google Workspace and Microsoft 365 are the most common choices for small businesses.
• A list of who needs mailboxes and which shared addresses (hello@, accounts@) should be aliases or groups.

Which DNS records do I need for email?

For a refresher on what each record type is, see DNS records explained.

How do I set up Google Workspace email on my domain?

1. Sign up and verify. Google gives you a TXT record starting google-site-verification=. Add it to your domain's root (@) and click verify.
2. Create users before switching mail flow, so nobody misses messages.
3. Add the MX record. Google now uses a single MX record:

@    MX    1    smtp.google.com.

Google says older Workspace accounts using the legacy aspmx records don't need to change them if mail is working. Remove any MX records from a previous provider.

4. Add SPF:

@    TXT    "v=spf1 include:_spf.google.com ~all"

5. Set up DKIM. In the Admin console go to Apps > Google Workspace > Gmail > Authenticate email. Google says you may need to wait 24 to 72 hours after turning on Gmail before you can generate the key. Choose 2048-bit (use 1024-bit only if your DNS host can't handle long TXT records), keep the default selector google, publish the TXT record at google._domainkey, then return and click Start authentication.

How do I set up Microsoft 365 email on my domain?

1. Add the domain in the Microsoft 365 admin centre under Settings > Domains and add the verification TXT record. If your registrar supports Domain Connect, Microsoft can add records for you.
2. Create users and mailboxes first, as Microsoft advises, so mail isn't lost when the MX changes.
3. Add the MX record. Copy the exact value from the admin centre's Add DNS records page (it's unique to your domain). Microsoft recommends priority 0 and a TTL of 3600:

@    MX    0    <value shown in your Microsoft 365 admin centre>

4. Add the autodiscover CNAME shown in the admin centre so Outlook configures itself.
5. Add SPF:

@    TXT    "v=spf1 include:spf.protection.outlook.com -all"

6. Set up DKIM. Add the two CNAME records Microsoft shows for selector1._domainkey and selector2._domainkey, then switch on Sign messages for this domain with DKIM signatures under Email authentication settings > DKIM in the Microsoft Defender portal (security.microsoft.com). Microsoft's documentation says outbound mail from custom domains isn't DKIM signed until you do this, so don't skip it.

What DMARC record should I add for a new domain?

Start in monitoring mode with a reporting address:

_dmarc    TXT    "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Once your reports show all legitimate mail passing, move to p=quarantine and then p=reject. MakeItFlow's free DMARC record generator builds the record for you, and DMARC explained covers the rollout.

What about other services that send as my domain?

This is where most new setups go wrong. Your website contact form, newsletter platform, CRM, invoicing tool and booking system may all send mail "from" your domain.

• Only one SPF record is allowed. Add each service's include to the same record, e.g. v=spf1 include:_spf.google.com include:sendgrid.net ~all, and stay within SPF's 10-lookup limit. The SPF record generator helps.
• Turn on DKIM in each service using the records it gives you.
• Keep website form mail authenticated. Send through your provider's SMTP or a transactional email service rather than the web server's default mail function.

How do I check my new email setup is working?

1. Send and receive test messages to and from a personal Gmail and Outlook.com address.
2. Check the headers. In Gmail, use Show original and look for SPF, DKIM and DMARC all showing PASS.
3. Check your DNS. The free DNS lookup, SPF checker and DKIM checker confirm each record.
4. Run a full scan. MakeItFlow's email deliverability check reviews MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI together, or you can run a free website audit to cover your website too.

DNS changes usually apply within minutes to a few hours, depending on TTLs. See DNS propagation explained if changes seem slow.

Frequently asked questions

Should I use Google Workspace or Microsoft 365?

Both handle business email well and support SPF, DKIM and DMARC. Choose based on the apps your team already uses: Gmail, Google Docs and Meet, or Outlook, Word, Excel and Teams. Switching later is possible but takes migration effort.

Can I use my domain for email if my website is hosted elsewhere?

Yes. Email and website are separate. The MX record points mail to your email provider, while A or CNAME records point your website to your host, and they can be different companies.

Should I use ~all or -all in my SPF record?

Both are widely used. -all asks receivers to fail unlisted senders outright; ~all marks them as soft fails. With DMARC in place, receivers rely on your DMARC policy, so the choice matters less. Google's example uses ~all, Microsoft's uses -all.

Do I need to warm up a brand-new domain?

For normal staff email, just use it normally. If you plan to send newsletters or campaigns, start small and increase gradually over several weeks, because new domains have no sending reputation.

Is my registrar's free email forwarding enough?

Forwarding can work for receiving, but replies often come from a different address and forwarded mail can fail SPF. A proper mailbox with SPF, DKIM and DMARC is more reliable and professional.

What to do next

Write down every service that will send as your new domain before you start, then add the records in the order above: verify, users, MX, SPF, DKIM, DMARC. A week after launch, check your DMARC reports and work through our email authentication checklist to confirm nothing was missed.

Sources

• Google Workspace Admin Help: Set up MX records for Google Workspace
• Google Workspace Admin Help: Set up DKIM
• Microsoft Learn: Connect your domain by adding DNS records
• Microsoft Learn: How to use DKIM for email in your custom domain
• Google Workspace Admin Help: Email sender guidelines