SPF, DKIM and DMARC: How to Make Business Emails Arrive Reliably

Business emails that end up in the spam folder cost orders and trust. Often the reason isn’t the content but missing or faulty DNS records. Three mechanisms largely determine whether emails from your domain arrive reliably: SPF, DKIM and DMARC. Since 2024, major mailbox providers have increasingly required proper authentication.

SPF: who may send for your domain?

The Sender Policy Framework (SPF) is a TXT record in your domain’s DNS. It defines which servers may send email on behalf of your domain. Receiving servers compare the actual sender with this list.

example.com.  TXT  "v=spf1 include:_spf.mailprovider.example ~all"

Important: there may only be one SPF record per domain, and evaluation allows a maximum of ten DNS lookups. If too many services are included, the record becomes invalid.

DKIM: the digital signature

With DomainKeys Identified Mail (DKIM), the sending server signs every email with a private key. You publish the matching public key in DNS under a so-called selector. The recipient checks the signature and can tell whether the message was altered in transit and really comes from your domain.

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg…"

DKIM usually has to be activated with your email provider, which also supplies the public key.

DMARC: the policy

DMARC combines SPF and DKIM and defines how recipients should handle emails that fail the checks. You can also request reports that show who is sending email on your behalf.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

• p=none – monitor only, no effect on delivery
• p=quarantine – suspicious emails go to the spam folder
• p=reject – suspicious emails are rejected

Introduce it step by step

1. Set up SPF and DKIM for all legitimate senders.
2. Start DMARC with p=none and analyze the reports.
3. Add missing senders – such as newsletter services, CRM or website forms.
4. Gradually tighten the policy to quarantine and finally reject.

Common mistakes

• several SPF records for the same domain
• forgotten senders: newsletters, ticket systems, accounting software or the website’s contact form
• too many DNS lookups in the SPF record
• DKIM not activated with the provider
• DMARC introduced directly with reject without analyzing reports first

And the website’s contact form?

Website forms often send emails using the web server’s default mail function. These messages frequently fail SPF and DMARC because the web server isn’t listed as a sender. Sending via SMTP through an authenticated mailbox on your own domain is more reliable – which is exactly how this website does it.

Conclusion

SPF, DKIM and DMARC are just a few DNS records with a big impact: your emails arrive more reliably, and third parties find it harder to misuse your domain. Introducing them step by step and analyzing DMARC reports keeps you in control.