SPF, DKIM and DMARC explained: why your emails land in spam

Email has an identity crisis. Anyone can send a message claiming to be from any address, so receiving servers — Gmail, Outlook, your customers' mail provider — need a way to tell genuine mail from forgeries. SPF, DKIM and DMARC are the three DNS records that provide it. Between them they decide whether your invoices, quotes and newsletters reach inboxes or quietly vanish into spam.

SPF: who is allowed to send for us?

An SPF record is a public list of the servers permitted to send email for your domain. When mail arrives claiming to be from you, the receiving server looks up the SPF record and checks the sending server is on the list. Fail the check, and the mail is already suspect.

The classic SPF mistakes:

• More than one SPF record. Two SPF records on a domain invalidates both — everything fails. Everything from newsletter platforms to CRMs must be merged into one record.
• The ten-DNS-lookup limit. Each include: counts towards a hard ceiling of ten lookups. Big stacks of includes silently break SPF entirely.
• Missing senders. Set up a new invoicing tool and forgot to add it? Its mail fails SPF forever.

DKIM: proof the message wasn't altered

DKIM attaches a cryptographic signature to every outgoing email. The receiving server fetches your public key from DNS and verifies the signature — proving the message genuinely came from your infrastructure and wasn't modified in transit. Where SPF vouches for the server, DKIM vouches for the message itself, and it survives forwarding, which SPF does not.

DKIM usually just works once your mail platform is configured, but it's worth checking the key is 2048-bit and the record is actually published. A DKIM selector that returns nothing means you're sending unsigned mail.

DMARC: what to do when checks fail

SPF and DKIM are checks. DMARC is the policy: it tells receiving servers what to do when mail fails both — deliver it anyway (p=none), quarantine it (p=quarantine), or reject it outright (p=reject). It also adds reports, so you get told who is sending email as your domain — which is how you discover the marketing platform nobody registered.

The sensible rollout, in order:

1. Publish p=none with reporting and watch for a couple of weeks. This is monitoring only — nothing gets blocked.
2. Fix every legitimate sender that's failing. There are always more than you expect.
3. Move to p=quarantine, then p=reject once reports come back clean.

Why this matters beyond spam folders

Since 2024, Google and Yahoo require SPF, DKIM and DMARC for anyone sending bulk mail — and Microsoft followed. Without them, mass mailings bounce. Phishing is the other half: a strict DMARC policy is the only thing stopping criminals sending convincing email as your domain to your customers. For any business that emails invoices, the fraud angle alone justifies an afternoon's work.

Check your domain in about five seconds with our free email security tool — it reads all three records, spots the multiple-SPF and lookup-limit traps, and grades the result. If it finds holes, fixing the DNS is exactly the kind of thing we handle under our technical work alongside a site project — it's one hour that protects every email you'll ever send.

Check your own site in seconds with our free email security tool — and if you’d rather hand the whole job over, talk to us.

Found this useful? Share on LinkedIn · Email it to someone