SPF, DKIM and DMARC explained: why your business emails land in spam

You send a quote to a new customer. They never reply. A week later you find out it went to their spam folder. It's a common problem, and it's usually not about the content of your email. It's about whether the receiving server can prove the email really came from you.

That's what SPF, DKIM and DMARC do. They're three records in your domain's DNS settings, and together they tell Gmail, Outlook and everyone else: "This email is genuinely from us."

Why this matters more than ever

Email providers have steadily tightened their rules. Since 2024, Google and Yahoo have required bulk senders to authenticate their mail with SPF and DKIM and to publish a DMARC policy. Even if you don't send bulk mail, properly authenticated email is simply trusted more, and unauthenticated email is increasingly treated with suspicion.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a list of the servers that are allowed to send email for your domain. It's published as a TXT record, something like:

v=spf1 include:_spf.google.com ~all

When an email arrives claiming to be from yourbusiness.com, the receiving server checks whether it came from a server on your list.

Common mistakes

• Forgetting other senders. Your website's contact form, your invoicing tool or your newsletter service may all send "as" your domain. Each needs to be included.
• Two SPF records. You can only have one. Multiple SPF records break it; combine them into one.
• Too many lookups. SPF allows a maximum of 10 DNS lookups. Long chains of include: entries can quietly exceed it.
• Leaving the old provider in place after a switch. When you move email to Google Workspace or Microsoft 365, replace the old provider's entry rather than just adding the new one.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a digital signature to each email you send. Your email provider signs messages with a private key, and you publish the matching public key in your DNS (a record like google._domainkey.yourbusiness.com). The receiving server checks the signature. If it matches, the email really came from your domain and wasn't altered on the way.

Common mistakes

• Never switching it on. Many providers require you to generate the key and add the DNS record yourself. Until you do, mail goes out unsigned.
• Forgetting third-party senders. Tools that send on your behalf often support DKIM too, but only if you add their records.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when an email fails SPF and DKIM checks, and where to send reports. It's a TXT record at _dmarc.yourbusiness.com, for example:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com

The key part is the policy (p=):

• p=none: monitor only; take no action. The safe place to start.
• p=quarantine: send failing emails to spam.
• p=reject: block failing emails entirely.

DMARC also checks alignment: the domain in the visible "From" address must match the domain verified by SPF or DKIM. That's what stops someone sending email that looks like it's from you.

The sensible path: start with p=none, read the reports to find every legitimate service sending as your domain, fix their SPF and DKIM, then move to quarantine and eventually reject. Jumping straight to reject can block your own invoices or website enquiries.

How to check your domain

You can check your records with free online tools. Search for an "SPF record checker" or "DMARC checker" and enter your domain. You can also open an email you sent to a Gmail account, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS.

Want it fixed properly?

Configuring SPF, DKIM and DMARC is part of every business email setup we do. We cover your email provider, your website's contact forms and any other tool that sends as your domain. If your emails are landing in spam, send us your domain name and we'll tell you what's missing.