Appearance
Summary
If you bought a custom domain (like @yourbusiness.com) and your emails keep ending up in your clients' spam folders, it is almost certainly because your SPF, DKIM, and DMARC records are missing. These three acronyms sound like terrifying IT jargon, but they are digital ID cards that prove to the internet that you are not a spammer.
Before You Start
- You must own a custom domain.
- You need access to your domain registrar's DNS settings (e.g., GoDaddy, Cloudflare).
Instructions
1. The Problem: Anyone can fake an email address
The email system was invented in the 1970s. By default, it has zero security. Without protections in place, a hacker can easily send an email that looks exactly like it came from [email protected].
To stop this, email providers (like Gmail and Microsoft) check three "records" hidden in your domain's DNS settings before they let an email into their user's inbox. If you don't have these records, Gmail assumes you are a hacker and throws your email in the spam folder.
2. SPF (Sender Policy Framework): The Guest List
What it is: SPF is a list of servers that are allowed to send email on your behalf. The Analogy: Think of SPF as a VIP guest list at a club. If Microsoft 365 tries to deliver an email for you, the bouncer (Gmail) checks your SPF list. If Microsoft is on the list, the email gets in. If Mailchimp tries to send an email for you, but Mailchimp isn't on the list, the bouncer rejects it. What you do: You add a simple text (TXT) record to your DNS that says v=spf1 include:spf.protection.outlook.com -all. This tells the internet "Only Microsoft is allowed to send my email."
3. DKIM (DomainKeys Identified Mail): The Wax Seal
What it is: DKIM is a digital cryptographic signature attached to every email you send. The Analogy: Imagine sending a letter in the 1800s. You melt wax on the envelope and press your unique signet ring into it. When the recipient gets the letter, they check the unbroken wax seal. It proves two things: 1) You actually sent it, and 2) Nobody opened the envelope and changed the contents while it was in transit. What you do: You click a button in the Microsoft 365 Admin Center to generate DKIM keys, and you paste those keys into your DNS settings as CNAME records.
4. DMARC (Domain-based Message Authentication): The Bouncer's Instructions
What it is: DMARC is a rule you publish that tells other servers what to do if an email fails the SPF or DKIM checks. The Analogy: You give the bouncer strict instructions: "If someone shows up claiming to be me, but they aren't on the SPF guest list, or they don't have the DKIM wax seal... throw them in the alley (Reject) or put them in the spam folder (Quarantine)." What you do: You add a TXT record to your DNS that says v=DMARC1; p=quarantine;. This tells the internet to quarantine any fake emails pretending to be you.
5. Why this matters now
In 2024, Google and Yahoo fundamentally changed how email works. They announced that if you send emails to a @gmail.com or @yahoo.com address, and you do not have SPF, DKIM, and DMARC set up, they will aggressively block your emails. It is no longer optional for small businesses.
Troubleshooting
WARNING
If you use marketing software like Mailchimp, Constant Contact, or HubSpot, you must add their specific servers to your SPF list and set up DKIM for them. Otherwise, your marketing newsletters will go straight to spam.
| Symptom / Error | Potential Cause | Solution |
|---|---|---|
| "Too many DNS lookups" in SPF | You added too many services | An SPF record can only "include" 10 other servers. If you add Microsoft, Google, Mailchimp, Zendesk, and 7 other tools, your SPF breaks. You must consolidate them. |
| DMARC reports show legitimate emails failing | Missing DKIM/SPF for a tool | Your DMARC policy is doing its job and blocking an unauthenticated sender. Figure out which tool is sending the emails and set up DKIM/SPF for it. |