If your email lands in the spam folder, or simply never arrives, the problem is most likely not the content: it is three missing DNS records. Gmail, Outlook and the other large providers have tightened their filters considerably, and today a domain without SPF, DKIM and DMARC falls into the suspicious-by-default category.
The good news is that these are three text records, configured once and working forever.
SPF: who may send on your behalf
SPF is a list of servers authorised to send mail using your domain. When a server receives a message claiming to come from your company, it looks up your SPF and checks whether the sending address is on the list.
It is a simple TXT record. What usually breaks is the omissions: the invoicing tool that sends invoices, the newsletter platform, the website form, the CRM. Anything sending mail with your domain must be included, or those messages will fail verification.
And an important warning: only one SPF record may exist per domain. Two SPF records do not add up, they invalidate verification. When you add a new service, you extend the existing record, you do not create another.
DKIM: the signature proving integrity
DKIM adds a cryptographic signature to every outgoing message. The recipient looks up your public key in DNS and verifies the signature. If it matches, they know two things: the message really came from an authorised server, and nobody altered it in transit.
DKIM has a practical advantage over SPF: it survives forwarding. When somebody forwards your mail, the sending address changes and SPF fails, but the DKIM signature remains valid. That is why you need both, not one.
DMARC: the policy and, above all, the reports
DMARC tells the recipient what to do when SPF and DKIM fail: nothing, quarantine or reject. But its most valuable function is another one: the reports.
With DMARC configured you receive periodic reports on who is sending mail with your domain. That is where you discover the legitimate services you forgot to include, and also whether someone is impersonating your brand. Without those reports you are blind.
The correct rollout order
This is where most people get it wrong. Starting straight with a reject policy blocks your own legitimate mail, and you find out when a customer tells you they never got the quote.
The safe sequence is:
- Publish SPF and DKIM and verify they work by mailing yourself at an external account.
- DMARC in none mode for two or three weeks. It blocks nothing, it only collects reports.
- Read the reports and add any legitimate services that appear and were not covered.
- Move up to quarantine, observe for another two weeks.
- And only then, reject.
That path takes a month and breaks nothing. The shortcut takes a day and breaks your email.
A note on subdomains
If you do not publish SPF for a subdomain, an attacker can try to impersonate it. Publish restrictive records for subdomains that do not send mail, and use DMARC’s subdomain policy to cover the rest.
How we handle it
In our managed DNS the panel lets you publish and edit these three records without wrestling with the syntax, and because it runs on a global anycast network queries are answered fast from anywhere, which is what you want while a receiving server decides whether your mail gets in. If you are coming from another provider and do not know how yours is set up, we will review it.