Business Email Deliverability: SPF, DKIM and DMARC

If your invoices, quotes and newsletters keep landing in spam, the problem is often not your wording. It is missing or broken email authentication. SPF, DKIM and DMARC are three small DNS records that prove your messages really come from you, and the big mailbox providers now expect them. Here is what each one does and how to set them up without a technical background.

Computer monitor on a desk showing an email inbox with a list of messages and folders — Authentication decides whether your emails reach the inbox or the spam folder.

Key takeaways

SPF lists the servers allowed to send email for your domain, DKIM adds a digital signature and DMARC tells receivers what to do when checks fail.
Since February 2024, Google and Yahoo require bulk senders to use all three, plus one-click unsubscribe and low spam complaint rates.
Every tool that sends email as your domain (your mailbox, newsletter platform, invoicing app, website forms) must be included in your setup.
Start DMARC at p=none to monitor, then tighten the policy once all legitimate senders pass.

Email deliverability means the share of your messages that actually reach the recipient's inbox, rather than bouncing or being filtered into spam. For a small business, poor deliverability is expensive in quiet ways: a quote nobody sees, a payment reminder that sits in junk, a password reset that never arrives.

Our article on domain and business email covers choosing a domain and a mailbox provider. This guide picks up from there and focuses on the authentication layer that sits on top. Providers change their dashboards and rules regularly, so use this as a map and confirm the details in your email provider's current documentation.

Why authentication matters now

Email was designed decades ago with almost no way to prove who sent a message. Anyone could put your address in the "From" line. Spammers and phishers took full advantage, so mailbox providers built filters that treat unauthenticated email with suspicion.

SPF, DKIM and DMARC are the industry's answer. They are published in your domain's DNS (the Domain Name System, the internet's address book where your domain's settings live). Receiving servers look them up and decide whether a message claiming to be from your domain is genuine.

February 2024 When Google and Yahoo began requiring bulk senders to authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe and keep spam complaints low Google sender guidelines and Yahoo sender requirements

Google defines bulk senders as those sending close to 5,000 or more messages a day to Gmail addresses. Most small businesses are well below that. But the rules for everyone else still matter: all senders need SPF or DKIM and valid reverse DNS (a setting that links a sending server's IP address back to a hostname, normally handled by your email provider). Microsoft announced similar requirements for high-volume senders to Outlook.com consumer addresses, enforced from 5 May 2025. In practice, setting up all three records is the simplest way to stay on the right side of every provider, whatever your volume.

SPF, DKIM and DMARC in plain English

Think of sending a letter from your office. Each record answers a different question the recipient might ask.

SPF: who is allowed to send?

SPF (Sender Policy Framework) is a single TXT record listing the services permitted to send email using your domain. When a message arrives, the receiving server checks whether it came from a server on that list. A typical record looks like this, with the "include" parts supplied by your email and marketing providers:

example.com.  TXT  "v=spf1 include:_spf.yourmailprovider.example include:mail.newsletterapp.example ~all"

The ending matters. ~all (soft fail) asks receivers to treat other senders with suspicion, while -all (hard fail) asks them to reject. You can have only one SPF record per domain, so add new services to the existing record rather than creating a second one.

DKIM: was the message changed?

DKIM (DomainKeys Identified Mail) adds a hidden digital signature to each message. Your provider holds a private key and you publish the matching public key in DNS. The receiver uses the public key to confirm the message really came from your domain and was not altered on the way. Each sending service usually gives you its own DKIM record with a unique name called a selector:

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=<long public key supplied by your provider>"

Some providers ask for a CNAME record instead, which points to a key they manage and rotate for you. Either way, copy the values exactly as your provider shows them.

DMARC: what happens when checks fail?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It checks alignment, meaning the domain in the visible "From" address matches the domain that passed SPF or DKIM. It also tells receivers what to do with failures and where to send reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

The policy (p=) has three levels: none (monitor only), quarantine (send failures to spam) and reject (block them). Google and Yahoo accept p=none for bulk senders, which makes it a safe starting point.

Record	Question it answers	Where it lives	Who gives you the values
SPF	Is this server allowed to send for the domain?	TXT record on your main domain	Each sending service gives you an "include" value
DKIM	Is the signature valid and the message unchanged?	TXT or CNAME record under a selector name	Each sending service generates its own key
DMARC	Does the From domain align, and what should happen if not?	TXT record at _dmarc	You write it, choosing the policy and report address

Step by step: set up your records

You will need access to wherever your DNS is managed. That is usually your domain registrar or your web host, and sometimes a separate DNS service. If you are not sure, look up who your domain's nameservers point to.

List every service that sends email as you. Include your mailbox provider, newsletter platform, invoicing or accounting software, online store, booking system, help desk and website contact forms. This list is the foundation of everything else.
Check what already exists. Use a free DNS lookup tool or your provider's setup checker to see your current SPF, DKIM and DMARC records. Many businesses discover an old SPF record from a previous provider.
Build one SPF record. Combine the "include" values from each sending service into a single record. Keep it tidy: SPF allows a limited number of DNS lookups, so remove services you no longer use.
Turn on DKIM for each service. In each tool's settings, look for domain authentication or DKIM. Add the records it provides, then return to the tool and confirm it shows as verified.
Publish a DMARC record at p=none. Add a report address you actually monitor, or a mailbox at a DMARC reporting service that turns the raw reports into readable summaries.
Test. Send a message to a personal Gmail address, open it, and use the "show original" view to check that SPF, DKIM and DMARC all say PASS. Repeat for each sending tool.
Review reports for a few weeks. DMARC reports reveal services you forgot, and anyone trying to spoof your domain. Fix legitimate senders before moving on.
Tighten the policy gradually. Once your real senders consistently pass, move to p=quarantine and later p=reject if you are comfortable. This is what actually stops criminals impersonating your domain.

Common mistake

Adding a second SPF record when you sign up for a new tool. Two SPF records on the same domain is treated as an error, and receivers may fail all of your mail. Always edit the existing record and merge the new "include" into it.

Hand holding a smartphone showing a message conversation with several chat bubbles on the screen — Customers read most messages on their phones, and only the ones that reach the inbox get read at all.

The other rules for marketing email

Authentication gets you through the door. For newsletters and promotions, mailbox providers also look at how recipients react. If you send marketing email in any volume, build these habits now, even if you are below the bulk sender threshold.

One-click unsubscribe. Bulk senders must support one-click unsubscribe through special email headers (defined in a standard called RFC 8058), not just a link in the footer. Reputable email marketing platforms add these for you; check that the feature is on.
Honor unsubscribes quickly. Google and Yahoo expect unsubscribe requests to be processed within two days.
Keep spam complaints low. Bulk senders must stay below a 0.3% spam complaint rate, and Google suggests staying under 0.1%. Complaints happen when people click "report spam," often because they do not remember signing up.
Send only to people who opted in. Buying lists or adding every business card you collected is the fastest way to complaints and blocked mail.
Clean your list. Remove addresses that bounce and consider removing people who have not opened anything in a long time.

0.3% The spam complaint rate bulk senders must stay below, with Google suggesting a target under 0.1% Google sender guidelines

Pro tip

Consider sending newsletters from a subdomain, such as news.example.com, while day-to-day email stays on example.com. Each subdomain builds its own reputation, so a campaign that draws complaints is less likely to drag down the delivery of your quotes and invoices. Your marketing platform's documentation will explain how to set this up.

Monitoring and troubleshooting

Deliverability is not a one-time project. Tools change, staff add new apps and providers update their rules. A little monitoring catches problems before customers do.

Google Postmaster Tools. A free Google service that shows how Gmail sees your domain, including spam rate and authentication results. It is most useful once you send a meaningful volume to Gmail users.
DMARC reports. Review the summaries monthly. A new unknown sender may be a tool someone on your team signed up for, or someone spoofing you.
Bounce messages. Read them rather than deleting them. They often name the exact reason, such as an authentication failure.
Test after every change. Whenever you add a new sending tool or switch providers, repeat the Gmail "show original" test.

Hypothetical example

Imagine a small design studio whose invoices suddenly start landing in clients' spam folders. The owner checks the message headers and sees that the invoicing app fails DKIM and SPF, because it was never added to the domain's setup. Mail from the studio's regular mailbox passes fine. After adding the app's include to the existing SPF record and publishing its DKIM key, the next test invoice shows PASS for all three checks and the complaints stop.

Signs your setup is healthy

One SPF record that lists every current sender
DKIM verified in each sending tool
A DMARC record with reports you actually read

Warning signs

Clients say your emails go to spam
Bounce messages mention authentication or policy
Unknown services appear in DMARC reports

Your email deliverability checklist

List every tool that sends email using your domain
Find out where your DNS is managed and confirm you can log in
Merge all senders into a single SPF record
Turn on and verify DKIM in every sending tool
Publish a DMARC record at p=none with a monitored report address
Test each tool by sending to a Gmail address and checking "show original"
Confirm one-click unsubscribe is enabled in your newsletter platform
Review DMARC reports monthly and tighten the policy when ready
Repeat the tests whenever you add or change an email tool

Frequently asked questions

Do these rules apply if I only send a few emails a day?

The strictest bulk sender rules apply to high volumes, but all senders to Gmail need SPF or DKIM, and authenticated mail is treated more favorably everywhere. Setting up all three records is worthwhile for any business that relies on email.

Will DMARC at p=reject stop my own emails?

It can if a legitimate sender is not set up properly, which is why you start at p=none, review reports and fix every real sender first. Move to stricter policies only when your reports show consistent passes.

My email provider says everything is set up. Do I still need to check?

Your mailbox provider may handle its own SPF and DKIM, but it cannot authenticate other tools you use, such as a newsletter platform or invoicing app. You still need a DMARC record and a quick test of each sending service.

Should I hire someone to do this?

Many owners can do it in an afternoon by following each provider's instructions. If your domain has many sending tools, a complicated history or a custom mail server, a short session with an IT provider can save time and avoid mistakes.

The bottom line

SPF, DKIM and DMARC are not glamorous, but they are the difference between emails that get read and emails that vanish. List every service that sends as your domain, publish one clean SPF record, verify DKIM everywhere, and start DMARC in monitoring mode. Then keep marketing email clean with opt-in lists and easy unsubscribes, and recheck your setup whenever your tools change.