You send a quotation to a client — and it lands in their spam folder. Or a customer receives a fake invoice that looks like it came from your company. Both problems usually have the same cause: your domain is missing three DNS records called SPF, DKIM and DMARC.
Why business emails end up in spam
Email was designed decades ago with no built-in way to prove who sent a message. Gmail, Outlook and other providers now look for that proof. If your domain can't provide it, your emails look suspicious — and anyone can pretend to be you.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a TXT record in your domain's DNS that lists the services allowed to send email for your domain — for example Microsoft 365, Google Workspace or your billing software.
Common mistakes are having two SPF records (only one is allowed) or forgetting a service like your CRM or billing tool.
DKIM: a digital signature
DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. The receiving server checks it against a public key published in your DNS. If the signature matches, the message genuinely came from your domain and wasn't changed on the way.
DMARC: what to do with fakes
DMARC tells receiving servers what to do when an email fails the SPF and DKIM checks: none (just report it), quarantine (send it to spam) or reject (block it). It also sends you reports showing who is sending email using your domain.
The safe approach is to start with monitoring (p=none), fix any genuine services that fail, then move to quarantine and finally reject.
Why it matters more than ever
Google and Yahoo now require bulk senders to authenticate their email with SPF, DKIM and DMARC, and mailbox providers increasingly treat unauthenticated mail with suspicion. Even if you send only a few emails a day, proper setup improves delivery and protects your brand from spoofing.
How to check your domain
- Send an email to a Gmail account, open it and choose Show original — you'll see whether SPF, DKIM and DMARC passed.
- Look at the TXT records in your domain's DNS settings.
- Or ask us for a free email check.
Setup checklist
- One SPF record that includes every service that sends email for you
- DKIM switched on in Microsoft 365, Google Workspace or your mail server
- A DMARC record, starting in monitoring mode
- Correct reverse DNS if you run your own mail server
- Review DMARC reports and tighten the policy over time
Moving email providers? These records are part of every migration we do — see how to move from cPanel email to Microsoft 365.
Frequently asked questions
Do small businesses really need DMARC?
Yes. DMARC helps stop criminals sending fake invoices in your company's name, and it helps your genuine emails reach the inbox.
Will setting up SPF, DKIM and DMARC break our email?
Not if it's done carefully — include every service that sends email for you in SPF, and start DMARC in monitoring mode before enforcing it.
How long does setup take?
Usually under an hour for a small business, followed by a few weeks of monitoring before moving to a strict DMARC policy.
Emails landing in spam?
We'll check your domain's SPF, DKIM and DMARC for free and fix whatever is missing.