The symptom

Customers say they never got the booking confirmation. Invoices sit in spam folders. Form acknowledgements arrive for some people and not others. Often the cause is that the tools sending these emails "from" your domain aren't authorised to.

What the three records do

  • SPF (RFC 7208) is a DNS record listing which servers may send mail for your domain.
  • DKIM (RFC 6376) adds a cryptographic signature to each email, which receivers check against a public key in your DNS.
  • DMARC (RFC 7489; overview at dmarc.org) tells receivers what to do when a message fails those checks, and sends you reports.

Major providers now expect these. Google's sender guidelines and Yahoo's sender best practices describe authentication requirements, with stricter rules for bulk senders, including easy unsubscribe for marketing mail (RFC 8058 covers one-click unsubscribe).

Step 1: list everything that sends as you

Make an inventory: your mailbox provider, website form, CRM, booking tool, invoicing tool, newsletter platform, and anything else that sends with your domain in the "From" address. Missing one sender is the most common reason a DMARC rollout causes problems.

Step 2: authorise each sender

Each tool's help pages explain which SPF include and DKIM records to add. Notes:

  • You should have one SPF record per domain, combining all senders. Two separate SPF records is a common error.
  • SPF has a limit on DNS lookups; too many includes can break it. If you have many senders, ask whoever manages DNS to check.
  • Enable DKIM in each tool that supports it, using your domain rather than the vendor's.

Step 3: start DMARC in monitoring mode

Publish a DMARC record with a monitoring policy (p=none) and a reporting address. Watch reports for a few weeks to confirm all legitimate senders pass. Only then consider moving to quarantine or reject. Report files are hard to read raw; many services summarise them.

Step 4: fix the sending habits too

  • Don't send customer messages from a no-reply address nobody monitors.
  • Keep transactional messages (receipts, reminders) separate from marketing where you can — some businesses use a subdomain for marketing.
  • Make the content match the purpose; see transactional vs marketing messages.
  • Remove addresses that bounce.

How to check

Send a test email from each tool to a personal mailbox, open the message headers ("Show original" in Gmail) and check that SPF, DKIM and DMARC show "pass". Repeat whenever you add a tool.

Questions

Will setting up SPF, DKIM and DMARC guarantee inbox delivery?

No. Authentication proves the email is really from you; providers still judge content, sending patterns and recipient complaints. It removes one major cause of spam filtering.

Can I break my email by changing DNS?

Yes, if records are entered incorrectly — for example, a strict DMARC policy before all senders are authenticated. Make changes carefully, one at a time, and start DMARC in monitoring mode.

Sources and further reading

Official documentation changes. Check the current version before you rely on a rule, limit or setting.

Next step

Start with one workflow worth fixing.

Bring the real steps, the tools you already use and the place the handoff gets stuck. We review feasibility, access and approval points before quoting — no instant integration promise.

Book an automation consultationFind your workflow gaps

See Business Automations for what we scope, or prepare a custom quote brief.