If your business emails land in spam, or someone is sending fake emails in your name, the cause is often missing email authentication. SPF, DKIM and DMARC are three DNS records that fix this. They sound technical, but the idea is simple.
The idea in plain English
Anyone can put your address in the “From” line of an email. These three records let receiving mail servers check that a message really came from you.
SPF: who is allowed to send
SPF is a list, published in your DNS, of the servers allowed to send email for your domain. If a message comes from a server that is not on the list, it looks suspicious. You usually have one SPF record, and it must include every service that sends mail for you, such as Microsoft 365 or Google Workspace, your invoicing tool and your newsletter service.
DKIM: a signature on every message
DKIM adds a digital signature to each outgoing email. The receiving server checks the signature against a public key in your DNS. It proves the message was not changed on the way and that it was sent by someone authorised. Your email provider gives you the records to add.
DMARC: what to do when checks fail
DMARC tells receivers what to do with messages that fail SPF and DKIM: do nothing, send to spam (quarantine) or reject. It can also send you reports so you can see who is sending mail as your domain.
Setting them up safely
- List every service that sends email as you. Include your mailbox provider, accounting software, CRM, helpdesk, website forms and newsletter tool.
- Add SPF including those services. Keep to a single SPF record.
- Turn on DKIM in each service and add the records they give you.
- Add DMARC in monitoring mode first (policy “none”) with a reporting address.
- Read the reports for a few weeks, fix anything that is failing, then move to quarantine, and later reject.
Common mistakes
- Having two SPF records, which breaks SPF.
- Forgetting a service, so its emails start failing.
- Jumping straight to a reject policy before checking the reports.
Frequently asked questions
Will this stop all spam to me?
No. It protects your domain’s reputation and helps stop others spoofing you. It does not filter incoming mail.
Do I need all three?
Yes. Together they are the standard for good email delivery and are required by some large mailbox providers for bulk senders.
Can you set this up for me?
Yes, it is part of our email and Microsoft 365 or Google Workspace setup.
