SPF, DKIM and DMARC Explained: Make Sure Your Business Emails Actually Arrive

Why this matters

Few things damage a small business quietly like emails that never arrive. A quote sits in a prospect's spam folder. An invoice reminder disappears. A password reset never shows up. Customers do not complain; they simply move on.

One of the most common causes is missing or misconfigured email authentication. Mailbox providers use authentication to decide whether a message claiming to come from your domain is genuine. In early 2024, Google and Yahoo began requiring authentication for bulk senders, and unauthenticated mail from any domain is increasingly treated with suspicion.

If you have not set up email authentication, your domain is easier to impersonate and your genuine emails are easier to doubt.

The three records in plain language

SPF: who is allowed to send

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers and services allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from an approved source.

A simple SPF record looks like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

This says: Google Workspace and Mailchimp may send for this domain; treat other senders with suspicion.

Important rules:

• You can have only one SPF record per domain. Multiple records cause failures.
• SPF has a limit of 10 DNS lookups. Too many "include" entries can break it.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email. The receiving server uses a public key published in your DNS to confirm that the message was not altered and genuinely came from an authorised sender.

Each sending service (your email provider, your newsletter tool, your invoicing system) usually gives you its own DKIM record to add. They do not conflict, because each uses a different "selector".

DMARC: the policy and the reporting

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when a message fails SPF and DKIM checks, and where to send reports.

A starting DMARC record might be:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The p=none policy means "monitor only, do not block anything yet". Once you are confident all legitimate email passes, you can move to p=quarantine (send failures to spam) and eventually p=reject (block them).

Step-by-step setup

Step 1: List every service that sends email as you

This is the step most people skip, and it causes most problems. Check:

• Your main mailbox provider (Google Workspace, Microsoft 365, or your host's email).
• Website contact forms and booking systems.
• Newsletter and marketing tools.
• Invoicing, accounting, and payment platforms.
• CRM and helpdesk tools.

Step 2: Configure SPF

Combine all legitimate senders into one SPF record. Each provider's documentation tells you which "include" value to use. End with ~all (soft fail) while you test.

Step 3: Enable DKIM for each sender

In each service's settings, find the domain authentication or DKIM section. Add the records they provide to your DNS, then click "verify" or "authenticate" in the service.

Step 4: Publish DMARC in monitoring mode

Add a DMARC record with p=none and a reporting address. Reports arrive as XML files, which are hard to read directly; a free or low-cost DMARC reporting tool can turn them into readable summaries.

Step 5: Review reports for a few weeks

Look for legitimate services that are failing. Fix their SPF or DKIM setup. Look for unknown sources sending as your domain; these may be impersonation attempts.

Step 6: Tighten the policy

When legitimate mail consistently passes, move to p=quarantine, then later p=reject. Move slowly; a mistake here can block your own email.

Monitor first, enforce later. DMARC rewards patience.

Common mistakes

• Two SPF records. Merge them into one.
• Forgetting the website form. Contact forms often send through the web server, which is not in SPF. Route form emails through an authenticated email service instead.
• Jumping straight to reject. You may block your own invoices.
• Ignoring reports. DMARC is only useful if someone reads the summaries.

Beyond authentication

Authentication is the foundation, but deliverability also depends on sending wanted email: keep lists clean, make unsubscribing easy, avoid misleading subject lines, and send consistently rather than in sudden bursts.

How email authentication works together

It helps to picture the three records as a team. SPF answers the question "Is this server allowed to send for this domain?" DKIM answers "Was this message signed by the domain and left unchanged?" DMARC ties them together by checking that the domain the recipient sees in the From address lines up with the domain that passed SPF or DKIM, and then tells receiving servers what to do if it does not.

Without DMARC, a message can pass SPF for one domain while showing a completely different domain to the reader. That gap is what impersonators exploit. With DMARC in place and enforced, it becomes much harder for someone to send convincing email pretending to be you.

Authentication does not make your emails interesting. It makes sure they get the chance to be read.

Rolling out DMARC safely

Moving straight to a strict DMARC policy can block legitimate email if you have not identified every service that sends on your behalf. A phased approach avoids that.

1. Start with monitoring. Publish a DMARC record with a policy of p=none and a reporting address so you can see who is sending mail as your domain.
2. Read the reports. Use a DMARC reporting tool to turn the raw reports into readable summaries.
3. Fix legitimate senders. Make sure your email platform, newsletter tool, CRM, invoicing software and website forms are covered by SPF or DKIM.
4. Move to quarantine. Once legitimate mail passes consistently, change the policy to p=quarantine, optionally starting with a percentage.
5. Move to reject. When you are confident, set p=reject so receiving servers refuse unauthenticated mail claiming to be from you.
6. Keep monitoring. Whenever you add a new tool that sends email, update your records before it goes live.

Services people forget

Many businesses send email from more places than they realise. Common examples include website contact forms, online stores, booking systems, invoicing and accounting tools, help desks, CRMs and marketing platforms. Each of these needs to be authenticated, either by including it in SPF or, better, by setting up DKIM signing with your domain. Keep a simple list of every service that sends email for you.

Watch the SPF lookup limit

SPF records are limited to ten DNS lookups. Each include: usually counts toward that limit, and some includes contain further lookups of their own. If you exceed it, SPF can fail for everyone. Remove services you no longer use, avoid duplicates, and rely on DKIM where possible rather than adding more includes.

How to check your current setup

Before changing anything, find out where you stand. Several free online tools let you enter your domain and see whether SPF, DKIM and DMARC records exist and whether they are valid. You can also send a test email to a personal Gmail account, open the message, and choose the option to show the original. Gmail will display whether the message passed SPF, DKIM and DMARC. If any of them fail or are missing, note which sending service the message came from, because that tells you where to start.

Write down what you find, including which DNS provider hosts your domain. Many problems turn out to be caused by DNS being managed somewhere other than where people expect, such as at a domain registrar rather than the hosting company.

Signs your email has a deliverability problem

Authentication problems often show up indirectly. Customers say they never received quotes or invoices. Replies to your newsletter are unusually low. Password reset emails from your website arrive late or land in spam. Colleagues at other companies ask whether you sent them something. If you notice any of these, checking your authentication records is a quick and inexpensive first step before looking at content or sending habits.

A quick reference for each record

SPF is a TXT record on your domain listing the servers allowed to send mail for it. It usually starts with v=spf1 and ends with a rule such as ~all or -all.

DKIM is a TXT or CNAME record published at a selector your email provider gives you. The provider signs outgoing mail with a private key, and receiving servers check the signature with the public key in your DNS.

DMARC is a TXT record published at _dmarc.yourdomain.com. It starts with v=DMARC1, sets a policy and can include an address for reports.

Always follow your email provider's own instructions for exact values, because each service uses its own include statements and selectors.

Beyond the records: sending habits

Authentication is the foundation, but sending habits also affect where your mail lands. Send marketing email only to people who have agreed to receive it, include a clear unsubscribe link, remove addresses that bounce and keep an eye on spam complaints. Separate marketing email from day-to-day business email where your tools allow it, often by using a subdomain for newsletters.

If you use a website contact form, check that it sends from an authenticated address on your domain or through a transactional email service set up for your domain. Form emails failing authentication is one of the most common reasons enquiries go missing.

Frequently asked questions

Do small businesses really need DMARC? Major mailbox providers have tightened their requirements for senders in recent years, and DMARC also helps protect your brand from impersonation. For most businesses, it is worth setting up.

Can I have more than one SPF record? No. A domain should publish only one SPF record. Combine all authorised senders into a single record.

How long do DNS changes take? Often minutes, sometimes longer depending on your DNS provider and the record's time-to-live setting.

Can you set this up for us? Yes. Our hosting and email services include DNS and deliverability setup. Contact us if your emails are landing in spam.

How we can help

DNS changes can be nerve-wracking if you have not done them before. Our team handles domain, DNS and SSL management, business email and workspace setup, and email migrations. Book a discovery call if your emails are going missing.