SPF, DKIM and DMARC in plain English
If your invoices or website enquiries keep landing in customers' junk folders, there's a good chance these three records are missing or wrong. They sound technical, and setting them up is, but the idea behind them is simple: they let the receiving mail server check that an email claiming to be from your business actually is.
Last updated
The short answer
SPF lists which servers are allowed to send email for your domain. DKIM adds a signature to each email that proves it wasn't changed and came from you. DMARC tells receiving servers what to do when a message fails those checks, and sends you reports. Gmail, Outlook and Yahoo now expect all three from business senders, and mail without them is far more likely to be marked as spam.
Why these records exist
Email was designed with no way to check who sent it. Anyone can put your address in the From line. SPF, DKIM and DMARC are DNS records on your domain that fix that, so mail servers can tell your real email apart from someone pretending to be you.
What each one does
SPF: the guest list
A record listing every service allowed to send mail as your domain: your mail provider, website, accounting software and newsletter tool.
DKIM: the wax seal
Each email is signed with a private key, and the matching public key sits in your DNS. If the signature checks out, the message is genuine and unaltered.
DMARC: the instructions
Tells receiving servers whether to deliver, quarantine or reject mail that fails SPF and DKIM, and sends you reports on who is sending as you.
Together: protection
Once all three are in place and DMARC is set to quarantine or reject, scammers can't easily send email that looks like it came from your domain.
Who this is for
- Businesses whose invoices, quotes or form emails go to customers' spam folders.
- Anyone who has had a customer receive a fake invoice that looked like it came from them.
- Businesses sending email from more than one system, like Microsoft 365 plus Xero plus a website form.
Setting them up safely
- List every sender. Find everything that sends mail as your domain: mail provider, website, accounting, CRM, newsletters, booking system.
- Publish one SPF record. Include every sender in a single SPF record. Two SPF records on the same domain break it.
- Turn on DKIM for each sender. Each service gives you a DKIM record to add to DNS. Microsoft 365, Google Workspace and cPanel all support it.
- Start DMARC on monitor. Begin with a policy of none and read the reports for a few weeks to catch any sender you missed.
- Tighten the policy. Once legitimate mail passes, move DMARC to quarantine and then reject so fake mail gets blocked.
How WaTo can help
- We find every system sending as your domain, which is usually more than people expect.
- We set up SPF, DKIM and DMARC for Microsoft 365, Google Workspace and our own email hosting.
- We read the DMARC reports and tighten the policy without blocking your own mail.
Email authentication questions
Do I need all three?
Yes. Google, Microsoft and Yahoo now expect SPF, DKIM and DMARC from business senders. Having only one or two still leaves gaps, and mail is more likely to be filtered.
Can setting up DMARC stop my own email?
It can if you jump straight to reject before every sender is covered. That's why you start on monitor, read the reports and tighten it in stages.
Where do these records go?
In your domain's DNS, wherever that's managed: your registrar, your host or a service like Cloudflare. They don't change your mailboxes or your website.
Will these records stop all spam reaching me?
No. They protect mail sent as your domain, and help other people's servers trust it. Incoming spam is handled by your mail filtering.
How WaTo can help with this
Sources & references
WaTo Consulting. Last reviewed 2026-10-17. Review after mail provider sender rule changes.
Emails landing in junk?
We'll check your domain's SPF, DKIM and DMARC and tell you exactly what's missing.
Mon to Fri, 8:30am to 5pm
