On this page
If your quotes and invoices keep landing in customers' spam folders, the cause is often three DNS records most small businesses have never looked at: SPF, DKIM and DMARC. Together they let the receiving mail server check that a message claiming to come from your domain really did.
Since 2024, Gmail and Yahoo have required senders to authenticate their email, with stricter rules for bulk senders, and Microsoft announced similar rules for high-volume senders to Outlook.com in 2025. Even if you send only a few dozen emails a day, these records are now the baseline for being trusted.
Here is what each one does and how to set them up.
SPF: who is allowed to send as you
SPF (Sender Policy Framework) is a single TXT record on your domain that lists the services allowed to send email using your address. A Google Workspace domain that also sends invoices from an accounting app might publish:
v=spf1 include:_spf.google.com include:[your invoicing app's SPF domain] ~all
A few rules matter more than the rest:
- One SPF record per domain. Two separate SPF records make SPF fail. When you add a new tool, edit the existing record instead of adding another.
- List every sender. Your email provider, plus any invoicing, CRM, newsletter or helpdesk tool that sends mail as your domain.
- Stay under 10 lookups. SPF allows at most 10 DNS lookups. Each include counts, and some count more than once. Too many and SPF fails.
- Start with ~all. The ending ~all (soft fail) is the safe choice while you set things up. Many domains move to -all later.
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. Your email provider keeps a private key, and you publish the matching public key in DNS. If a message is forged or changed on the way, the signature won't match.
In Google Workspace, you generate the key in the Admin console under Apps, then Google Workspace, then Gmail, then Authenticate email. You publish it as a TXT record (by default at google._domainkey on your domain), wait for DNS to update, and then click Start authentication. That last step is easy to miss: until you click it, Google doesn't sign your mail.
Every other service that sends as your domain has its own DKIM setup. Look in its help pages for "domain authentication."
DMARC: what to do when checks fail
DMARC ties the other two together. It tells receiving servers what to do with mail that fails SPF and DKIM checks for your domain, and where to send reports about it. It is a TXT record at _dmarc on your domain. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
With p=none, nothing is blocked. Instead, mailbox providers send daily reports to the address you list, showing which services send as your domain and whether they pass. The reports are XML files, so a free DMARC report viewer makes them much easier to read.
Once every legitimate sender passes, tighten the policy to p=quarantine (failing mail goes to spam) and later p=reject (failing mail is refused). Jumping straight to reject without monitoring first is how businesses accidentally block their own invoices.
The three records at a glance
| Record | Where it goes | What it does |
|---|---|---|
| SPF | TXT record on yourdomain.com | Lists the services allowed to send as you |
| DKIM | TXT record at selector._domainkey.yourdomain.com | Publishes the key that verifies each message's signature |
| DMARC | TXT record at _dmarc.yourdomain.com | Sets the policy for failed checks and where reports go |
How to check your setup
Send a message from your domain to a personal Gmail address, open it, and choose Show original from the three-dot menu. Gmail shows the SPF, DKIM and DMARC results at the top. You want PASS on all three. Then repeat the test from each tool that sends as you, such as your invoicing software.
Common mistakes
- Two SPF records after someone added a new tool. Merge them into one.
- DKIM published but never switched on in the admin console.
- A forgotten sender. The newsletter tool someone set up two years ago still needs SPF and DKIM.
- Moving to p=reject on day one. Monitor first.
- Editing DNS in the wrong place. Your domain registrar and your DNS host can be different companies. Changes only count where your domain's nameservers point.
When to get help
If you can log in to your DNS provider and your email admin console, you can usually finish this in an afternoon. If nobody is sure who controls the domain, or several tools send mail as you, it's worth mapping every sender first. Our email and Google Workspace service covers exactly that, and an IT review catches it alongside other gaps.
Frequently asked questions
Do I need DMARC if I only send a few emails a day?
Yes. The strictest requirements apply to bulk senders, but a DMARC record in monitoring mode costs nothing, makes it harder for someone to impersonate your domain, and helps your everyday mail get delivered.
How long do DNS changes take to work?
Often a few minutes, sometimes up to 48 hours, depending on the record's time-to-live (TTL) setting and your DNS provider. Wait before testing, and avoid stacking several changes while an earlier one is still spreading.
Can setting this up break my email?
Not if you start DMARC at p=none and test each sender before tightening it. SPF edits are the main risk, so save a copy of the old record before you change it.
BookedTeam
Written by BookedTeam (BookedTeam LLC), an IT consulting company that sets up and supports email, phones, websites, cloud hosting and automation for small businesses.
Related services