Email guide
Business Email Going to Spam? Setting Up SPF, DKIM and DMARC Correctly
If customers regularly find your invoices and quotes in their junk folder, the cause is usually not the content of the message. Receiving systems check whether your domain has authorized the server that sent it. Three DNS records control that check, and most small organizations have at least one of them missing or wrong.
What each record does
| Record | Purpose |
|---|---|
| SPF | Lists the servers and services permitted to send mail for your domain. |
| DKIM | Adds a cryptographic signature to each message so the receiver can confirm it came from your domain and wasn't altered. |
| DMARC | Tells receivers what to do when a message fails SPF and DKIM checks, and sends you reports on who is sending as your domain. |
Major mailbox providers, including Google and Yahoo, now expect authenticated mail and apply stricter requirements to organizations that send in high volumes. A domain without these records is at a measurable disadvantage.
Step-by-step
Inventory every service that sends as your domain
Before editing DNS, list everything that sends email using your domain name: Microsoft 365 or Google Workspace, your accounting or invoicing system, CRM, website contact forms, marketing platforms, and devices such as copiers. Each of them must be accounted for in SPF or DKIM, or its mail will start failing once DMARC is enforced.
Publish a single, accurate SPF record
A domain must have exactly one SPF record. For Microsoft 365 it includes
include:spf.protection.outlook.com; other services provide their own include value. A combined record looks like:v=spf1 include:spf.protection.outlook.com include:_spf.example-crm.com -allSPF evaluation is limited to ten DNS lookups. Exceeding that limit causes SPF to fail outright, which is a frequent and easily missed problem in domains that have added services over the years.
Enable DKIM signing
In Microsoft 365, DKIM for a custom domain is enabled from the Microsoft Defender portal under the email authentication settings. Microsoft provides two CNAME records (
selector1._domainkeyandselector2._domainkey) to publish in DNS, after which signing can be switched on. Third-party senders such as marketing platforms provide their own DKIM records; set those up as well.Start DMARC in monitoring mode
Publish a TXT record at
_dmarc.yourdomain.comwith a monitoring policy and a reporting address:v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comUse a dedicated mailbox or group for reports. For the first few weeks, review the reports to identify any legitimate service you missed in step 1.
Move to enforcement in stages
Once reports show all legitimate mail passing, change the policy to
p=quarantine, optionally phased in with thepcttag, and then top=reject. At that point, messages forged in your domain's name are rejected by receivers that honor DMARC, which also protects your customers from invoice fraud using your name.
Checking your work
Send a message from each sending service to an external mailbox and view the message headers. The Authentication-Results header should show spf=pass, dkim=pass and dmarc=pass. Any failure tells you which service still needs attention.
Common mistakes
- Two SPF records on the same domain, usually after a new service's setup instructions were followed literally.
- Moving straight to
p=rejectwithout monitoring, which blocks legitimate mail from forgotten systems. - Leaving parked or unused domains without a record. A domain that never sends mail should publish
v=DMARC1; p=reject;so it can't be used for spoofing.