A customer says your password reset never arrived. A supplier finds your invoice in their junk folder. Often the message was sent fine; the receiving mail server simply could not confirm that it really came from you.
Gmail, Outlook and other providers check three DNS records on your domain before trusting a message: SPF, DKIM and DMARC. Missing or broken records are one of the most common reasons legitimate business email goes to spam, and one of the easiest to fix.
What each record does
SPF lists the servers allowed to send email for your domain. It is a single TXT record that starts with v=spf1.
DKIM adds a signature to each message. The receiving server checks it against a public key published in your DNS, which shows the message was not altered and was sent by someone holding your key.
DMARC tells receivers what to do when a message fails those checks, and where to send reports about it. It also requires the domain people see in the From line to match the domain that SPF or DKIM verified.
Think of SPF as the guest list, DKIM as the signature on the letter and DMARC as the instruction to the doorman about anyone who fails both.
Why this matters more than it used to
Gmail now requires every sender to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail addresses needs SPF, DKIM and DMARC, with the From domain aligned. Google’s sender guidelines list the full requirements, including a spam rate below 0.3%. Other large providers apply similar rules.
Smaller senders are not exempt from filtering. A domain without these records simply has less evidence in its favour when a filter makes a decision.
The mistakes I see most often
Two SPF records
A domain can have only one SPF record. Adding a second one for a new service, instead of merging it into the first, makes SPF fail for everything. The fix is one record that includes every sending service.
Too many lookups
SPF allows at most 10 DNS lookups while it is evaluated. Each include for a mail provider, CRM or newsletter tool uses at least one, and some use several. Past the limit, SPF returns an error even though every service is listed.
A service sending as you without DKIM
Your website, booking system or invoicing tool may send mail from your address. If that service is not in SPF and does not sign with DKIM for your domain, its messages fail. Each service has its own setup steps, usually a few DNS records to copy.
DMARC that nobody reads
A DMARC record with p=none and a report address is a good start. It only helps if someone reads the reports, finds the services that fail, fixes them and then moves the policy to quarantine or reject.
Check your domain in a minute
My free email deliverability check reads your live DNS and shows your mail provider, your SPF record and its lookup count, the DKIM selectors it can find, your DMARC policy and reports, MTA-STS, TLS reporting and whether the domain appears on common blocklists. Each result comes with a plain explanation of what to change.
It cannot see inside your mailbox or a recipient’s spam filter. Content, sending volume and complaint rates also affect delivery. Authentication is the part you control in DNS, so it is the right place to start.
A safe order for fixing it
List every service that sends email using your domain: your mailbox provider, website, shop, booking tool, newsletter and invoicing.
Merge them into one SPF record and keep it under the lookup limit.
Turn on DKIM in each service and publish the records it gives you.
Publish DMARC with p=none and a report address, then read the reports for a few weeks.
When legitimate mail passes, move DMARC to quarantine, then to reject.
Changing these records carelessly can stop email for the whole domain, so make one change at a time and check after each step.
When to ask for help
If the check shows several problems, or you are not sure which services send as you, send me the domain and the services you use. I can work out the records and the order to change them, and set up the sending side of an application so its emails pass these checks from the start.