SPF, DKIM & DMARC Setup for Real Estate Agents

If your listing alerts, offer follow-ups, and closing reminders keep landing in spam, the problem usually isn't your writing. It's that the big mailbox providers can't confirm your email is really coming from you. Google and Yahoo now expect every sender to prove that, and they enforce it with three email authentication records: SPF, DKIM, and DMARC. Set them up once, correctly, and you stop fighting the spam folder for good.

This is a plain-English setup guide for agents, team leads, and brokerage owners — not IT staff. For the wider picture on why deliverability matters to your pipeline, start with our pillar guide on real estate email deliverability and use this page as the hands-on companion.

What are SPF, DKIM, and DMARC?

SPF, DKIM, and DMARC are three DNS records that together prove an email genuinely came from you and wasn't forged. SPF says which mail servers are allowed to send on your behalf, DKIM adds a tamper-proof signature, and DMARC tells receiving inboxes what to do when a message fails those checks. Think of them as the ID, the signature, and the house rules for your domain's email.

SPF — who is allowed to send

SPF (Sender Policy Framework) is a list of the servers permitted to send email using your domain. When you send from Microsoft 365, for example, the receiving inbox checks your SPF record to confirm the message really left an authorized server. If your marketing platform or CRM also sends on your behalf, it needs to be included in that same record.

DKIM — proof it wasn't tampered with

DKIM (DomainKeys Identified Mail) attaches an invisible cryptographic signature to every message. The receiving server uses a matching key published in your DNS to confirm the email is authentic and unchanged in transit. For agents, this is what stops a scammer from spoofing your name on a fake wire-transfer email to a buyer at closing.

DMARC — the enforcement policy

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together. It tells inboxes what to do with mail that fails SPF or DKIM — spam it or reject it — and it sends you reports on who is trying to send as your domain. Without DMARC, SPF and DKIM are locks with no instructions for when someone fails the test.

Why do real estate agents get flagged as spam?

Because agents send high-volume, high-stakes email from a mix of tools — Outlook, a CRM, an e-signature platform, a marketing tool — all claiming to be your domain. That's exactly the pattern spam filters and spoofers exploit, and if those senders aren't authenticated, providers quietly downgrade you.

Two things make this worse in real estate. First, wire fraud: your closing emails are a prime target for impersonation, and DMARC is your best defense against a spoofed address. Second, tool sprawl — most agents run consumer email plus three or four disconnected apps, none aligned under one authenticated domain. Consolidating onto a managed foundation — what a managed foundation includes — is what makes authentication hold together instead of breaking every time you add a tool.

How to set up SPF, DKIM, and DMARC step by step

The setup happens in your domain's DNS settings — the same place you manage your website's records — and it follows a fixed order. Do SPF and DKIM first, then layer DMARC on top once those are confirmed working.

1. Inventory every tool that sends email as you. Microsoft 365 or Outlook, your CRM, e-signature, and any marketing or drip platform. You can only authenticate what you've listed.
2. Publish your SPF record. Create a single SPF record that includes Microsoft 365 and every other authorized sender. A common mistake is having two separate SPF records — you're only allowed one, so all senders must live in that one line.
3. Turn on DKIM for each platform. In Microsoft 365, enable DKIM signing for your domain and publish the two keys it generates. Repeat for any other sending platform that offers DKIM — most do.
4. Start DMARC in monitoring mode. Publish a DMARC record set to p=none first. This changes nothing for recipients but starts collecting reports, so you can see who is sending as your domain and whether anything legitimate is failing.
5. Tighten the policy. After a couple of weeks of clean reports, move DMARC from p=none to p=quarantine, then p=reject. That's what blocks spoofed mail — but only step up once every real sender passes.

How do I check whether it's working?

Send a test email to a Gmail account, open it, and view the original or headers — you want to see "PASS" next to SPF, DKIM, and DMARC. Free authentication checkers will also read your records and flag problems. If any of the three fails, fix that record before you tighten your DMARC policy.

Common mistakes that quietly hurt deliverability

• More than one SPF record. Two SPF lines invalidate each other. Merge them.
• Adding a new tool and forgetting to authenticate it. A new marketing platform that isn't in your SPF or signed by DKIM will fail — and once you're on p=reject, its mail vanishes.
• Jumping straight to p=reject. Do this before monitoring and you can block your own newsletters and offer emails.
• Setting it and never reading the DMARC reports. Those reports are how you catch impersonation attempts early.

When it's worth handing this off

If you send from one tool and rarely change platforms, you can maintain this yourself. But most agents and teams don't operate that way — they add and swap tools constantly, and every change can silently break authentication. That's the case for a managed foundation where records stay aligned as your stack evolves. You can compare plans and seats, or book a consult and we'll audit what you have first.

Genesis AI provisions and manages complete AI infrastructure for real estate professionals — a Microsoft 365 foundation, AI workflows and automation, and an optional Genesis CRM layer, fully managed month over month. That includes keeping SPF, DKIM, and DMARC correct as your tools change, so your emails keep reaching the inbox. Book a consult at geai.us.