If your quotes and invoices keep landing in customers’ spam folders, there’s a good chance three DNS records are missing or wrong. They have awkward names, but the ideas are simple.
Why this matters now
Email providers have become much stricter. Since 2024, Gmail and Yahoo have required everyone who sends to them to use SPF or DKIM, and they require SPF, DKIM and DMARC from bulk senders. Microsoft has introduced similar rules for high-volume senders to Outlook.com addresses. Even if you only send a few emails a day, these records help prove your email is genuine.
SPF: who is allowed to send
SPF is a list, published in your domain’s DNS, of the services allowed to send email as you. If you use Microsoft 365 and a newsletter tool, both need to be on the list.
Common mistakes:
- Two SPF records. You can only have one, so merge them.
- Too many lookups. SPF allows a maximum of 10 DNS lookups, and going over can make it fail.
- Ending in +all, which allows anyone to send as you. Use -all or ~all instead.
DKIM: proof the email is genuine
DKIM adds a digital signature to each email you send. The receiving server checks it against a public key in your DNS. If it matches, the server knows the email really came from your domain and wasn’t changed on the way.
Your email provider creates the keys, and you add one or two records to your DNS. Microsoft 365 and Google Workspace both support this, but you usually have to switch it on yourself.
DMARC: what to do with fakes
DMARC tells receiving servers what to do when an email claims to be from you but fails the checks. It has three settings:
- p=none: just monitor. Nothing is blocked.
- p=quarantine: send suspicious email to spam.
- p=reject: refuse it completely.
Without DMARC, scammers can send emails that look like they’re from your business, for example fake invoices to your customers. Many businesses start with p=none, check their reports, then move to quarantine or reject.
How to check yours
Our free email health check reads your public DNS records and tells you in plain English what’s set up and what’s missing. It never touches your actual email.
How to fix it
You’ll need access to wherever your domain’s DNS is managed, such as GoDaddy or 123 Reg, and to your email provider’s admin area. It’s a short job if you know what you’re doing, but mistakes can stop email working, so take care. If you’d rather not risk it, we can set it up for you at a fixed price.
Common questions
Do I need all three?
Yes, ideally. SPF and DKIM prove your email is genuine, and DMARC tells receiving servers what to do when it isn’t. Together they protect your deliverability and your reputation.
Will setting these up break my email?
Not if it’s done carefully. The usual approach is to start DMARC with a “none” policy, check that all your real email passes, then tighten it.