SPF, DKIM and DMARC explained simply
If your business emails keep landing in customers' spam folders, the cause is very often three missing or broken records in your domain's DNS. Here's what each one does, in plain words, and how to check yours.
Why they exist
Anyone can put your address in the "from" line of an email. That's how most phishing works. SPF, DKIM and DMARC let the receiving mail server check whether a message claiming to be from your domain really came from you. Big mailbox providers increasingly expect them, and mail that fails is more likely to be filtered or rejected.
SPF: who is allowed to send
SPF is a single text record listing the servers allowed to send mail for your domain: your mailbox provider, and any service that sends on your behalf, such as a website contact form, a newsletter tool or your booking system.
- A domain should have only one SPF record; two records break it
- Every service that sends as you must be included, or its mail fails
- There's a limit on how many lookups the record can trigger, so long lists need care
DKIM: a signature on every message
DKIM adds a digital signature to each email. The matching public key is published in your DNS, so the receiver can check that the message came from your domain and wasn't altered on the way. Your mail provider gives you the DKIM record to add; each sending service usually has its own.
DMARC: your instructions
DMARC tells receiving servers what to do with mail that fails SPF and DKIM: deliver it anyway, send it to spam or reject it. It can also send you reports showing who is sending mail using your domain.
Start with a monitoring policy that changes nothing, read the reports for a few weeks to find any legitimate senders you forgot, then tighten it. Jumping straight to rejecting can block your own mail.
How to check yours
- Send an email from your business address to a Gmail account
- Open it, choose "Show original" from the menu
- Look for SPF, DKIM and DMARC: each should say PASS
Do the same for mail sent by your website form or any other tool that emails customers. A form that sends "from" your domain through an unlisted server is a very common cause of lost enquiries.
Common mistakes
- Two SPF records after switching providers
- A new tool sending as your domain without being added to SPF or DKIM
- DMARC set to reject before checking that all your real mail passes
- Editing DNS at the wrong place, because the domain's nameservers point somewhere else
I set up all three when I set up business email, and check them for any form or tool I connect. If your domain itself needs sorting out first, see choosing a domain and hosting and domains.