If your invoices land in your customers' spam folders, or someone sends fake emails that look as if they came from your company, the cause is often the same: three small entries in your domain's DNS settings are missing or wrong. They are called SPF, DKIM and DMARC. You never see them, but every large mailbox provider checks them before it decides where your email goes.

This guide explains what each one does, what Gmail and Outlook now require, and how to set them up without breaking the emails your business already sends.

SPF: who is allowed to send for your domain

SPF (Sender Policy Framework) is a TXT record in your DNS that lists the servers allowed to send email for your domain: your mailbox provider, your newsletter tool, your booking system, the contact form on your website. A receiving server checks whether the message came from one of them.

Two rules cause most problems in practice:

  • Only one SPF record per domain. The SPF standard (RFC 7208) does not allow several. If a new tool asks you to "add an SPF record", add its entry to the existing one instead of creating a second record.
  • A limit of ten DNS lookups. Each include: for a service counts. Above ten, the check ends with an error (permerror), and DMARC then treats SPF as failed.

DKIM: a signature that proves the email is genuine

DKIM (DomainKeys Identified Mail) adds a digital signature to every email. The matching public key sits in your DNS. The receiver uses it to check that the email really comes from your domain and was not changed on the way.

Every service that sends email in your name needs its own DKIM key, usually a record that the service gives you to copy into your DNS. Google requires a key of at least 1024 bits for mail to personal Gmail accounts.

DMARC: what receivers should do when the checks fail

DMARC builds on the other two. It is a TXT record under _dmarc.yourdomain.com and does two things.

First, it checks alignment. An email passes DMARC only if SPF or DKIM passes and the domain that passed matches the domain in the visible "From" address. This is what stops someone from sending mail as you@yourdomain.com through their own server.

Second, it tells receivers what to do with mail that fails, through the policy:

PolicyWhat happens to failing mail
p=noneDelivered as normal. You only receive reports.
p=quarantineDelivered to the spam folder.
p=rejectRejected and not delivered.

With the rua tag you name an address for aggregate reports. Google recommends always including it. The reports show which servers send mail in your name and whether they pass, which is exactly what you need before you tighten the policy.

What Gmail and Outlook require

Since 1 February 2024, Google requires every sender to Gmail accounts to use SPF or DKIM, to send over an encrypted connection, to have valid reverse DNS for its sending servers and to keep the spam rate reported in Postmaster Tools below 0.3 percent.

Anyone sending more than 5,000 messages a day to Gmail accounts must additionally use SPF and DKIM, publish a DMARC record (the policy may be none), align the From domain with SPF or DKIM, and offer one-click unsubscribe in marketing emails.

Microsoft applies similar rules to Outlook.com, Hotmail and Live: senders of 5,000 or more messages to these services need SPF, DKIM and a DMARC record of at least p=none that passes. Mail that does not meet them is rejected with the error code 550 5.7.515.

Most small businesses stay well below 5,000 emails a day. Setting up all three records is still worth it: it protects your name against fake emails, and invoices, quotes and booking confirmations are far less likely to end up in spam.

Setting it up in six steps

  1. List everything that sends email for your domain. Your mailbox, website forms, newsletter tool, invoicing, booking and shop systems. Missing one here is the most common reason for problems later.
  2. Create or fix one SPF record that includes all of them, and count the lookups.
  3. Switch on DKIM in each of these services and add the records they give you to your DNS.
  4. Wait about 48 hours, as Google recommends, then add a DMARC record with p=none and a rua address for reports.
  5. Read the reports for a few weeks. Every legitimate sender should pass. If one fails, fix its SPF or DKIM first.
  6. Tighten the policy to quarantine and later to reject, once all legitimate mail passes.

A quick test: send an email from each system to a Gmail address, open it and choose "Show original". Gmail lists the result for SPF, DKIM and DMARC at the top. All three should say PASS.

Quick checklist

  • All services that send email in your name listed
  • Exactly one SPF record, with no more than ten lookups
  • DKIM switched on for every sending service
  • DMARC record under _dmarc, starting with p=none and a report address
  • Test email from each system showing PASS for SPF, DKIM and DMARC
  • Policy tightened step by step once the reports are clean

Setting up and checking these records is part of our email, CRM and messaging service, together with newsletters and automated follow-ups that actually reach the inbox. Review requests are a good example of emails that must reach the inbox, and our guide on asking for Google reviews without breaking the rules shows how to send them properly.

Get in touch