SPF, DKIM, and DMARC for Nigerian senders: a practical setup guide

Since 2024, Gmail and Yahoo require every sender to authenticate their mail. In 2026 this is not optional and it is not advanced. If your domain does not have SPF, DKIM, and DMARC set up correctly, your password resets and receipts will be filtered or rejected, and you will not always get a clear error telling you why. Here is how to get all three right.

What each one does, briefly

SPF says which servers are allowed to send mail for your domain. DKIM cryptographically signs each message so the receiver can confirm it was not tampered with and really came from you. DMARC ties the two together, tells receivers what to do when a message fails, and asks them to send you reports. You need all three. They are complementary, not alternatives.

SPF

SPF is a single TXT record on your domain that lists your authorised senders. If you send through SendByte, it looks like this:

yourcompany.com.  TXT  "v=spf1 include:spf.sendbyte.africa -all"

Two rules matter. First, you get exactly one SPF record per domain. If you already have one for another service, you merge the include into it rather than adding a second record. Second, end with -all, which means “reject anything not listed,” once you are confident every legitimate sender is included. While testing, ~all (soft fail) is a safer default.

A common failure is the ten-lookup limit: SPF allows at most ten DNS lookups, and stacking many include entries blows past it and silently breaks SPF. Keep the list lean.

DKIM

DKIM is usually set up as one or more CNAME records that point at keys your provider manages, so rotation happens without you touching DNS again:

sb1._domainkey.yourcompany.com.  CNAME  sb1.dkim.sendbyte.africa.
sb2._domainkey.yourcompany.com.  CNAME  sb2.dkim.sendbyte.africa.

After you add the records, the provider verifies the key before signing turns on. Do not remove the old records during a key rotation until the new ones are confirmed live, or you will sign with a key the receiver cannot find.

DMARC

DMARC is a TXT record at _dmarc.yourcompany.com. The mistake people make is going straight to the strictest policy and bouncing their own mail. Roll it out in three stages over a few weeks.

Start in monitor mode, which changes nothing but starts the reports flowing:

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com"

Read the reports for a week or two. Confirm that all of your legitimate mail, including anything sent by other tools, passes SPF or DKIM with alignment. Then tighten to quarantine, which sends failures to spam:

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com"

Once quarantine is clean, move to reject, which blocks failures outright and is what fully protects your domain from spoofing:

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com"

Gotchas specific to Nigerian domains

A few things trip up local setups more than they should. Some Nigerian registrars and the registries behind .ng and .com.ng domains have control panels that mangle TXT records, splitting long strings or appending the root domain twice. After you save a record, always verify what actually published rather than what you typed.

Shared hosting control panels often inject their own SPF record automatically. If your host already added one, you merge into it instead of creating a second, because two SPF records is the same as none in the eyes of a receiver.

DNS propagation through some local providers can be slow, so give changes up to a few hours before concluding they failed.

Verify it

Do not guess. Once your records are in, run your domain through the free deliverability audit, which inspects SPF, DKIM, DMARC, and MX and tells you exactly what is missing or misconfigured. If mail is still landing in spam after authentication checks out, the cause is usually reputation or content, which we cover in why your transactional email lands in spam.

Authentication is the foundation everything else sits on. Get these three records right once and most of your deliverability problems disappear. For the wider picture, the 2026 guide to sending transactional email in Nigeria puts this step in context.