The quote you sent a customer never reached them because it ended up in the spam folder. Or worse: someone using an address that looks like your company’s has sent your customers fake emails with fraudulent bank details. Both problems share the same root cause: your domain does not tell the world’s email services which servers are allowed to send email on your behalf.
Major email providers such as Gmail and Outlook have become stricter in recent years and explicitly require high-volume senders to have SPF, DKIM and DMARC configured. For every company, having these three records is now a practical requirement.
SPF: Which Servers Are Allowed to Send?
SPF is a TXT record in your domain’s DNS that lists the servers authorized to send email for the domain. The receiving server checks whether the email came from one of these servers. A simple example:
v=spf1 mx ip4:203.0.113.10 include:_spf.example.com ~all
In this example, the domain’s MX servers, the address 203.0.113.10 and the servers of another service added with include are authorized. The final part defines what happens to everything else: ~all means mark it as suspicious, and -all means reject it.
Key points about SPF:
- Each domain should have only one SPF record; two separate records cause an error.
- Add every service that sends email on your behalf: your mail server, SMS and bulk email platforms, and your e-commerce software or CRM.
- SPF allows a maximum of 10 DNS lookups (such as include); too many includes make the record invalid.
DKIM: A Digital Signature on Every Email
DKIM adds a digital signature to every outgoing email. The private key stays on the mail server, and the public key is published in a TXT record in DNS, usually with a name like selector._domainkey.company.com. The recipient uses the public key to verify the signature and confirm that the email really came from your domain and was not altered in transit.
Mail servers such as SmarterMail can generate DKIM keys; just create the key, add the record to DNS and enable signing.
DMARC: The Final Policy and Reporting
DMARC tells the recipient what to do if an email fails SPF and DKIM, and asks recipients to send you reports on emails they have seen using your domain. The DMARC record is a TXT record named _dmarc.company.com:
v=DMARC1; p=none; rua=mailto:dmarc@company.com
The p value sets the policy:
- p=none: reporting only; no email is rejected. Use it to start and to identify all sending sources.
- p=quarantine: invalid emails go to spam.
- p=reject: invalid emails are rejected outright; the strongest protection against spoofing.
Recommended path: start with p=none, review the reports for a few weeks to make sure every authorized service is covered by SPF and DKIM, then move to quarantine and finally to reject.
Other Factors That Affect Email Delivery
- PTR record (Reverse DNS): the mail server’s IP address should point to the server’s name and match it.
- Server IP reputation: if the server’s IP is on blacklists, emails are rejected or marked as spam. Check the lists regularly.
- Email content: sensational subject lines, suspicious shortened links and executable attachments raise the spam score.
- Compromised mailboxes: if a mailbox password leaks and it is used to send spam, the reputation of the entire server suffers. Take strong passwords and multi-factor authentication for webmail seriously.
How to Check
Send an email to a Gmail mailbox and open the Show original option in Gmail. There, the SPF, DKIM and DMARC results are displayed as PASS or FAIL. Online DNS record checkers can also reveal syntax errors in your records.
Checklist
- A single SPF record that includes every sending service
- DKIM signing enabled and its record published in DNS
- A DMARC record with an address for receiving reports
- A correct PTR record for the mail server’s IP
- Regular blacklist checks
- Strong passwords and multi-factor authentication for mailboxes
ITPlus724 business email is set up on SmarterMail servers with exactly these settings. If your company’s emails are landing in spam, ITPlus724 engineers can review and fix your domain records.