SPF DKIM DMARC Explained: Stop Your Emails Landing in Spam

When quotes go unanswered, invoices sit in a client’s junk folder, or newsletter open rates fall off a cliff, the cause is often not the message but the domain it comes from. Mailbox providers no longer trust email that cannot prove where it came from, and the proof is three DNS records: SPF, DKIM and DMARC. Getting SPF DKIM DMARC setup right is the single most important deliverability fix a small business can make, and it is mostly a one-afternoon job.

This guide explains what each record does in plain terms, then walks through the setup in the order that avoids breaking your own email along the way.

Why email authentication matters now

Email was designed with no built-in way to check the sender, which is why spoofing and phishing are so easy. Email authentication fills that gap, and the large mailbox providers now insist on it. Since February 2024, Google and Yahoo have required all senders to authenticate their mail, and senders of more than 5,000 messages a day to their users to have SPF, DKIM and DMARC in place, offer one-click unsubscribe on marketing email, and keep spam complaint rates low. Microsoft announced similar requirements for Outlook.com consumer domains in 2025.

Even if you send far fewer than 5,000 emails a day, the direction is clear: unauthenticated mail is treated with suspicion, and authenticated mail from a domain with a good reputation gets the benefit of the doubt.

SPF DKIM DMARC explained in plain English

The part most people miss: alignment

SPF checks the technical “envelope” sender (the Return-Path), which is often your email platform’s domain rather than yours. DKIM can be signed with the platform’s domain too. Both can pass and still say nothing about the address your customer sees in the From line. DMARC fixes that by requiring alignment: at least one of SPF or DKIM must pass and use your domain (or a subdomain of it, in the default relaxed mode). This is why connecting a newsletter tool or CRM properly means adding its DKIM records to your DNS, not just ticking a box.

Step one: find everything that sends as your domain

Before touching DNS, make a list. Most small businesses send from more places than they realise:

• Your mailbox provider — usually Google Workspace or Microsoft 365.
• Your email marketing tool — the newsletter platform covered in the email marketing guide for small businesses.
• Your CRM, if it sends follow-ups, reminders or lead nurturing sequences.
• Your website — WordPress contact-form notifications, WooCommerce or Shopify order emails.
• Invoicing, booking and helpdesk tools that send “from” your address.

Each one needs to be covered by SPF, DKIM or ideally both. A forgotten service will start failing the day DMARC moves to enforcement, so this list is worth getting right.

Setting up the records

You add these at your DNS host — usually your domain registrar, Cloudflare, or your web host. Every provider’s screen looks different, but each record has the same three parts: type, host or name, and value.

1. Create or fix the SPF record.

   Publish a single TXT record on the root domain (host @) listing each sender. For a business on Google Workspace that also uses a marketing platform, it looks something like v=spf1 include:_spf.google.com include:[your platform's value] ~all. Use the exact include value each provider documents. There must be only one SPF record per domain — if you find two, merge them. SPF also has a limit of ten DNS lookups, and includes inside includes count, so do not add services you no longer use.

2. Turn on DKIM for your mailbox provider.

   In Google Workspace, DKIM is generated in the admin console and published as a TXT record (the default selector is google), then you click to start authenticating. Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey, then you enable signing in the Defender portal. Use a 2048-bit key where your DNS host supports it.

3. Turn on DKIM for every other sender.

   Marketing platforms and CRMs call this “domain authentication”, “sender authentication” or setting up a dedicated sending domain. They give you one or more CNAME or TXT records to add. If you use GoHighLevel, the dedicated sending domain step is part of the GoHighLevel CRM setup guide. Once the records verify, the platform signs mail with your domain and DMARC alignment passes.

4. Publish a DMARC record in monitoring mode.

   Add a TXT record with host _dmarc and a value such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The policy p=none changes nothing about delivery; it simply asks receivers to send you daily aggregate reports. Use a mailbox you will actually check, or a DMARC reporting service that turns the XML reports into readable summaries.

5. Read the reports for two to four weeks.

   The reports show every server sending as your domain and whether it passed SPF and DKIM with alignment. Legitimate services that fail need fixing (usually a missing DKIM setup). Unknown senders are either forgotten tools or someone spoofing you.

6. Move to enforcement gradually.

   When legitimate mail passes consistently, change to p=quarantine (failures go to spam), optionally using pct to apply it to a portion of mail first. After another clean period, move to p=reject, which tells receivers to refuse mail that fails. That is the point at which your domain is properly protected against spoofing.

Reading the DMARC record

You only need a handful of tags for a small business setup:

Testing your SPF DKIM DMARC setup

1. Send an email from each service on your list to a personal Gmail address.
2. Open it, use the three-dot menu and choose Show original. Gmail shows SPF, DKIM and DMARC results at the top — you want PASS for DMARC, and the DKIM line should mention your domain.
3. Repeat for Outlook.com if many of your customers use it; the message headers show the same results.
4. Check the DNS records with your DNS host’s lookup tool or a reputable DNS checker to confirm there is exactly one SPF record and one DMARC record.
5. If you send marketing email in volume, register the domain in Google Postmaster Tools to see reputation and spam complaint rates over time.

Beyond the records: the rest of deliverability

A working SPF DKIM DMARC setup gets you through the door; behaviour keeps you welcome. A few habits matter as much as the DNS:

• Send marketing from a subdomain such as news.yourdomain.com if you send in volume, so a bad campaign does not damage the reputation of your everyday business mail.
• Only email people who asked. Bought lists and years-old contacts produce complaints and bounces, which hurt reputation quickly.
• Make unsubscribing easy, with a visible link and one-click unsubscribe headers on marketing mail (most reputable platforms add these for you).
• Clean the list regularly — remove hard bounces and long-term non-openers.
• Keep the From name and address consistent so recipients recognise you.

Common mistakes

• Two SPF records on the same domain, which makes SPF fail entirely.
• An SPF record that exceeds the ten-lookup limit after years of added includes.
• Connecting a newsletter tool without completing its domain authentication, so mail is signed with the platform’s domain and DMARC alignment fails.
• Publishing p=reject on day one and silently losing the website’s form notifications.
• Sending DMARC reports to an address nobody reads.
• Forgetting parked or unused domains — publish v=spf1 -all and a reject DMARC policy on domains that never send, so they cannot be spoofed.
• Changing DNS hosts during a website migration and leaving the email records behind.

Further reading: Google: email sender guidelines · RFC 7489: DMARC · RFC 7208: SPF.

FAQ

Want SPF, DKIM and DMARC set up across your mailbox, CRM and marketing tools, with the reports checked before enforcement? See the email and CRM setup services — it is usually a short job that fixes problems people have lived with for years.