SPF, DKIM and DMARC in plain English: the DNS records that keep you out of spam

You have your own domain and an address like name@company.com, yet your messages to clients land in spam or never arrive at all. It is not your fault, and it is not the client's. The problem, almost always, is that the servers receiving your mail have no way to confirm you are really you.

Gmail, Outlook and the rest check every incoming message through three mechanisms: SPF, DKIM and DMARC. They are three records you add to your domain's DNS — a set of public rules that tell servers which systems are allowed to send on your behalf. Without them, your mail starts at a disadvantage. In this article I take them one by one, in plain language, and show you exactly what to add and in what order, with no needless jargon.

Why your emails actually land in spam

When you send a message, the recipient's server has no way to know whether it truly comes from you or from someone using your domain name. It is like a letter where anyone can write "from company.com" on the envelope.

To avoid being fooled, the big providers ask for proof. They look in your domain's DNS for three public signatures:

• SPF — which servers are allowed to send mail in your name
• DKIM — a signature proving the message was not altered in transit
• DMARC — what the server should do when a message fails SPF or DKIM

If these are missing, your mail is not necessarily blocked, but it falls into spam easily. If they are set correctly, you clear the filter with far more trust. The good news: you configure them once and they stay in place.

SPF — the list of servers allowed to send

SPF (Sender Policy Framework) is a single TXT record in your DNS. It lists the servers authorised to send from your domain: Google Workspace, Microsoft 365, a newsletter tool, your hosting server.

A typical value looks like this:

v=spf1 include:_spf.google.com ~all

• v=spf1 declares it is an SPF policy
• include:... adds a provider's servers (here, Google)
• ~all means "treat the rest as suspicious, but do not hard-reject"

Two traps to avoid: you can have only one SPF record per domain (if you use several providers, put them all on the same line with multiple include statements), and SPF allows at most ten lookups — do not cram in dozens of services. If you send only through Google or only through Microsoft, the value above, adapted, is all you need.

DKIM — the signature that proves the message is genuine

DKIM (DomainKeys Identified Mail) adds a digital signature to every email, invisible to the recipient. The receiving server uses a public key from your DNS to confirm the message really comes from you and was not altered along the way.

In practice you do not write the key yourself. Your email provider (Google, Microsoft, the newsletter tool) generates it, and you simply add it to DNS — usually as a TXT or CNAME record with a name like selector._domainkey.company.com.

• In Google Workspace you enable it from Admin, under Apps > Gmail > Authenticate email
• In Microsoft 365 from Defender, in the email policy section

It matters that you enable DKIM for the tools you use for bulk sending too (newsletters, invoicing), not just your main inbox. Each has its own selector, so its own record.

DMARC — the rule that ties it together and gives you reports

DMARC is what turns SPF and DKIM from isolated checks into a real policy. It tells recipient servers what to do when a message fails authentication — and, on top of that, it sends you reports about who is sending from your domain.

The record is also a TXT, named _dmarc.company.com:

v=DMARC1; p=none; rua=mailto:reports@company.com

• p=none — you only monitor, nothing is rejected (this is how you start)
• p=quarantine — failing messages go to spam
• p=reject — failing messages are refused entirely
• rua= — the address where you receive the reports

The golden rule: start with p=none for a few weeks, read the reports to confirm your legitimate mail passes, then move up gradually to quarantine and only finally to reject. Jumping straight to reject without checking risks blocking your own emails.

The right order, and who can set it up for you

In short, the healthy order is: SPF first, then DKIM, then DMARC on p=none, and only once the reports show everything is clean do you raise DMARC to quarantine and reject. You add them in your domain's DNS panel (at the registrar or host), and changes can take anywhere from a few minutes to a day to propagate.

You test by sending a mail to a Gmail address: open the message, choose "Show original" and look for PASS next to SPF, DKIM and DMARC.

If this all reads like gibberish, that is normal — one misplaced comma can break everything. At MPO Web Studio we configure SPF, DKIM and DMARC as part of delivering a website, fully remote, with no need to come anywhere. If you just want a quick check of your domain, message us on WhatsApp and we will look together at what is missing.