SPF, DKIM and DMARC Explained: Stop Business Emails Landing in Spam

The Short Answer

SPF lists which servers may send email for your domain. DKIM adds a digital signature to each message so receivers can check it was not altered. DMARC tells receiving servers what to do when a message fails those checks and sends you reports. Set up all three and your legitimate email is far more likely to reach the inbox, while fake email sent in your name is more likely to be blocked.

Why This Matters Now

Mailbox providers have tightened their rules. Since 2024, Google and Yahoo have required senders of large volumes of email to authenticate with SPF, DKIM and DMARC, and authenticated mail is treated more favourably for everyone. If your domain has none of these records, your messages are more likely to be filtered and more easily impersonated.

SPF: Who May Send for Your Domain

SPF is a TXT record on your domain. It lists the services allowed to send mail for you. For a domain that sends only through Google Workspace it looks like this.

v=spf1 include:_spf.google.com ~all

If you also send through other services, such as a newsletter platform or a website contact form, each one must be included in the same record. A domain should have only one SPF record, so combine entries instead of adding a second record.

DKIM: A Signature on Every Message

DKIM uses a pair of keys. Your email provider signs outgoing mail with a private key and you publish the matching public key in DNS. Receivers use it to verify the signature.

Your provider, such as Google Workspace or Microsoft 365, generates the DKIM record in its admin console. You then add it to your DNS and switch signing on. Each service that sends mail for your domain needs its own DKIM setup.

DMARC: The Policy and the Reports

DMARC is a TXT record at _dmarc.yourdomain.com. It checks that SPF or DKIM passes and aligns with the visible From address, and tells receivers what to do if it does not.

A safe starting record only monitors.

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

The reports show who is sending mail using your domain, including services you forgot about.

The Safe Order to Set Them Up

1. Make a list of every service that sends email as your domain.

2. Publish one SPF record that includes all of them.

3. Turn on DKIM for each service and add its record.

4. Publish DMARC with p=none and read the reports for a few weeks.

5. Fix any legitimate sender that fails, then move the policy to quarantine and finally reject.

Moving to reject too early can block your own genuine email, which is why monitoring first is important.

How to Check Your Setup

Send a test message to a Gmail address, open it, choose Show original and look for SPF, DKIM and DMARC marked as PASS. Free online checkers can also read your DNS records and point out mistakes.

If you use Google Workspace or Microsoft 365 through webzworld, our team can help you add these records to your domain.

Frequently Asked Questions

Do I need all three?

Yes. Each covers a different weakness and DMARC depends on SPF and DKIM.

Will this stop all spam to my inbox?

No. These records protect how your domain is used and trusted by others, they do not filter spam sent to you.

How long do DNS changes take?

Often minutes, but they can take up to a day or more to be seen everywhere.