SPF, DKIM and DMARC: why your business emails land in spam and how to fix it.

Your quotes, invoices and order emails are going to spam, or not arriving at all. Customers say they never got them. Often the cause is not what you wrote. It is that the receiving mail server cannot prove the email really came from you.

Three DNS records fix that proof: SPF, DKIM and DMARC. They are free to set up. This guide explains what each one does and how to add them, in plain words.

What the three records do

Think of your domain, such as yourbusiness.co.za, as your letterhead. Anyone can print your letterhead. These records let the receiving server check whether a letter is real.

• SPF is a list of the services allowed to send email for your domain. It lives in one TXT record.
• DKIM adds a digital signature to each email. The receiving server checks the signature against a public key you publish in your DNS. If the email was changed on the way, the check fails.
• DMARC tells receiving servers what to do when an email fails the SPF and DKIM checks: deliver it anyway, put it in spam, or reject it. It also asks them to send you reports.

SPF and DKIM prove an email is genuine. DMARC ties them to the address your customers see in the From line, and sets the rule for failures.

Why it matters more now

The large mailbox providers have made these records an expectation rather than a nice extra.

At the time of writing (October 2026), Google's sender guidelines say that anyone sending to Gmail addresses must set up SPF or DKIM. Senders of more than 5,000 messages a day to Gmail must have SPF, DKIM and DMARC, and marketing emails must offer one-click unsubscribe. Yahoo set similar rules at the same time.

Microsoft followed for Outlook.com, Hotmail and Live addresses. Its announcement for high-volume senders said that from May 2025, mail from domains sending more than 5,000 messages a day without SPF, DKIM and DMARC would go to the junk folder, with rejection to follow.

A small business may never reach 5,000 emails a day. The direction is still clear: unauthenticated email is treated with suspicion everywhere, so set all three up.

Step 1: list everything that sends email as you

This is the step most people skip, and it causes most of the problems. Your domain probably sends email from more places than you think. Check for:

• Your mailbox provider, such as Google Workspace or Microsoft 365, or the email that came with your hosting.
• Your website's contact form.
• Your online shop's order and shipping emails, from Shopify or WooCommerce.
• Your newsletter tool, such as Mailchimp.
• Your accounting software, if it emails invoices from your address.
• Your CRM or help desk.

Write each one down. Every one of them needs to be covered by SPF, DKIM or both.

Step 2: publish one SPF record

Your SPF record is a single TXT record on the root of your domain. It starts with v=spf1, lists each sender, and ends with a rule for everything else.

For a business whose mailboxes are on Google Workspace, it looks like this:

v=spf1 include:_spf.google.com ~all

For Microsoft 365, the include is usually include:spf.protection.outlook.com. Each other sender adds its own include before the last part. Every provider publishes the exact include to use in its help pages, and some newsletter tools no longer need one because they rely on DKIM. Copy the value from the provider's own help page rather than from a forum post.

Three rules keep SPF working:

1. Only one SPF record per domain. Two records starting with v=spf1 make SPF fail. If a new tool asks you to add one, add its include to your existing record instead.
2. Stay under ten lookups. The SPF standard allows at most ten DNS lookups. Each include counts, and some includes contain more. Remove services you no longer use.
3. End with ~all while you test. It marks other senders as suspicious without rejecting them. You can move to -all once everything passes.

Step 3: switch on DKIM for each sender

DKIM is set up inside each sending service, not just in your DNS. Look in the service's admin or domain settings for "DKIM" or "authenticate your domain". The service gives you one or more records to add, usually a TXT record or a CNAME record with a name like google._domainkey.

Add the records to your DNS exactly as given, wait for them to take effect, then go back to the service and press the button to verify or start signing. In Google Workspace you have to start signing in the admin console after adding the record. Until you do, the record does nothing.

Do this for every service on your list from step 1 that offers DKIM. Shopify, most newsletter tools and most CRMs do.

Step 4: add DMARC, starting gently

DMARC is one TXT record at _dmarc.yourbusiness.co.za. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.za

p=none means "deliver as normal, but send me reports". The reports arrive as files from each mailbox provider and show every service sending as your domain, and whether it passed. A free DMARC report reader makes them easy to read.

After a few weeks, once every real sender passes, tighten the policy:

1. Move to p=quarantine, which sends failing mail to spam.
2. Watch the reports for another few weeks.
3. Move to p=reject, which blocks failing mail completely.

This order matters. Jumping straight to p=reject can block your own invoices if one sender was missed.

Step 5: check your work

Send an email from each service to a Gmail address you control. Open it, choose the three-dot menu, then "Show original". Gmail shows a line each for SPF, DKIM and DMARC. You want all three to say PASS.

Repeat for your contact form, your shop and your newsletter tool. Our free email domain health check also reads your SPF, DKIM, DMARC and MX records and lists what to fix.

Common mistakes

• Two SPF records. Usually left behind when a new tool was added. Merge them into one.
• Records added at the wrong place. Your DNS may be managed by your domain registrar, your hosting company or a service such as Cloudflare. Changes only count where your domain's name servers point.
• A contact form sending "from" the visitor. If your website sends form emails with the visitor's address in the From line, they will fail DMARC. Send from your own address and put the visitor's address in Reply-To.
• Mail sent straight from shared hosting. Website emails sent by the server's built-in mail function often fail checks. Send them through your mailbox provider or a transactional email service instead.
• Moving to p=reject too early. Wait until the reports show every real sender passing.

When the records pass but mail still lands in spam

Authentication proves who you are. It does not prove people want your email. If all three records pass and mail still goes to spam, look at:

• Your list. Send marketing only to people who agreed to receive it, and remove addresses that bounce.
• Complaints. Google asks senders to keep their reported spam rate below 0.3%, and recommends staying below 0.1%.
• Unsubscribe links. Make them easy to find. People who cannot leave press "report spam" instead.
• Content. Very short emails with only a link, or emails that are one large image, look like spam.

Most businesses can set up all three records in an afternoon once they know every service that sends as them. If you would rather we did it, we set them up, read the DMARC reports and move you to a strict policy safely.