IT Consultancy
SPF, DKIM and DMARC: Why Your Business Emails Land in Spam
If your invoices and proposals keep ending up in spam folders, email authentication is the first thing to check. A plain-English guide to SPF, DKIM and DMARC, and what Gmail now requires of senders.
SAG Encoders · · 2 min read
Professional email on your own domain (you@yourcompany.com) builds trust and keeps company accounts under company control when staff move on. But simply having a domain is not enough: if receiving mail servers cannot confirm that a message really came from you, they are more likely to send it to spam or reject it. Three DNS records solve this: SPF, DKIM and DMARC.
SPF: who is allowed to send for your domain
Sender Policy Framework is a TXT record in your domain's DNS that lists the servers and services permitted to send email as your domain. A business using Google Workspace might publish:
v=spf1 include:_spf.google.com ~allTwo rules catch many people out. A domain must have only one SPF record, so every sending service has to be combined into it. And SPF allows at most 10 DNS lookups when it is evaluated; long chains of include: entries can break that limit and cause SPF to fail.
DKIM: a signature that proves the message is genuine
DomainKeys Identified Mail adds a cryptographic signature to each outgoing message. The matching public key is published in your DNS under a "selector", for example google._domainkey.yourcompany.com. Receiving servers use it to confirm that the message was authorised by your domain and was not altered on the way. Most email providers generate the key for you; you just add the record they give you.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM to the address people actually see in the "From" line. A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the From domain. Your DMARC record, published at _dmarc.yourcompany.com, tells receivers what to do with messages that fail, and where to send reports:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.comp=none: deliver as normal, but send me reports. Start here.p=quarantine: treat failing messages as suspicious (usually the spam folder).p=reject: refuse failing messages. This gives the strongest protection against people impersonating your domain.
What Gmail requires
Since 1 February 2024, Google's sender guidelines require every sender to Gmail accounts to set up SPF or DKIM, have valid forward and reverse DNS, use TLS, and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of 5,000 or more messages a day must also use both SPF and DKIM, publish a DMARC record (a policy of p=none is enough), align the From domain, and support one-click unsubscribe in marketing messages. Yahoo introduced similar requirements at the same time.
A safe way to roll it out
- List everything that sends email as your domain: your mailbox provider, website contact forms, invoicing or accounting software, newsletter tools and CRM.
- Add each service to your single SPF record and switch on DKIM in each service.
- Publish DMARC with
p=noneand read the reports for a few weeks to find anything you missed. - Tighten the policy to
quarantine, thenreject, once legitimate mail is passing consistently.
Free DNS lookup tools can show whether your records are published correctly. If your domain was set up years ago and nobody is sure what sends email for it, this short audit usually pays for itself in delivered invoices alone.