Email deliverability: SPF, DKIM, and DMARC in plain English

If customers tell you your quotes went to spam, or your invoices never arrived, the cause is often three settings you have never heard of. They are called SPF, DKIM, and DMARC, and they tell the world which email really comes from your business. Here is what each one does, in plain English, and how to check yours today.

Why this matters more than it used to

Gmail and Yahoo both publish requirements for anyone who sends email to their users. Google's email sender guidelines (opens in a new tab) took effect in February 2024, and Yahoo's sender best practices (opens in a new tab) cover the same ground. Every sender needs at least SPF or DKIM. Bulk senders need SPF, DKIM, and DMARC.

Google's sender guidelines FAQ (opens in a new tab) says messages that do not meet the requirements might be rejected or delivered to spam. It defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts in a 24-hour period, counting all mail from the same primary domain. Once you cross that line, Google treats you as a bulk sender from then on.

Even if you are nowhere near that volume, these settings protect your business. They help your real mail get delivered, and they make it harder for scammers to send email pretending to be you.

The three settings, explained

All three live in your domain's DNS, the public settings that tell the internet where your website and email live. You or your IT provider add them as text records.

SPF: the approved sender list

SPF, short for Sender Policy Framework, is a list of the servers and services allowed to send email for your domain. When a message arrives claiming to be from you, the receiving server checks whether it came from somewhere on your list.

The catch is that most businesses send email from more places than they realize: your main email provider, your website's contact form, your invoicing tool, your newsletter service, your CRM, your booking system. Every one of them needs to be accounted for.

One more rule: a domain should have only one SPF record. Adding a second one, often by following a new service's setup instructions without checking, can cause SPF to fail for everything.

DKIM: the tamper-proof signature

DKIM, short for DomainKeys Identified Mail, adds a digital signature to every message you send. The receiving server checks that signature against a public key you publish in your DNS. If it matches, the receiver knows two things: the message really came from your domain, and nobody changed it along the way.

Each service that sends email for you needs its own DKIM setup. Most email providers and marketing tools walk you through it.

DMARC: the policy and the report

DMARC, short for Domain-based Message Authentication, Reporting, and Conformance, ties the other two together. It tells receiving servers what to do when a message claims to be from your domain but fails the checks. It also requires alignment, which means the domain in the visible From line has to match the domain that passed SPF or DKIM.

DMARC has three policy levels:

• None: take no action, just send me reports. This is where everyone should start.
• Quarantine: send failing messages to spam.
• Reject: block failing messages entirely.

The reports are the quiet benefit. They show you every service sending mail as your domain, including ones you forgot about and ones that are not yours at all. The usual path is to start at none, read the reports, fix your real senders, then move up to quarantine and eventually reject.

Two quiet problems that hurt your reputation

Mailbox providers judge your domain by how its mail behaves over time. Two common habits work against you.

Mailboxes that do not exist

Sending to old addresses that no longer exist creates bounces. A steady stream of bounces looks like a sender who does not keep a clean list, and that can drag down how your mail is treated. Remove addresses that bounce instead of sending to them again and again.

The opposite problem matters too. If your website form or app sends from an address like noreply@ that cannot receive mail, customer replies vanish. And if your DMARC reports point to a mailbox that does not exist, you never see them.

Contact forms deserve a special look. Many put the visitor's own email address in the From line. That makes your server look like it is impersonating your visitor's email provider, which can fail DMARC. The safer setup sends from your own domain and puts the visitor's address in the Reply-To field.

Forwarding spam

Lots of small businesses forward an address like info@ to a personal Gmail inbox. The forwarder sends along everything, including spam. Google's guidance on forwarding email to Gmail (opens in a new tab) recommends filtering spam before it is forwarded, and warns that when people mark forwarded messages from your domain as spam, future messages from your domain are more likely to be marked as spam too.

Forwarding can also break SPF, because the forwarding server is not on the original sender's approved list. That is one more reason DKIM matters, since a signature can survive the trip when SPF does not. If you can, use a real mailbox instead of a forward, or filter spam before anything is passed along.

How to check yours today

You do not need special software to start.

1. Send yourself a test. Send an email from your business address to a personal Gmail account. Open it, click the three-dot menu next to Reply, and choose Show original. Near the top, Gmail shows whether SPF, DKIM, and DMARC passed or failed. Gmail's help page on viewing full headers (opens in a new tab) walks through the steps.
2. Test every tool that sends as you. Repeat the test with your contact form, your invoices, your newsletter, appointment reminders, and anything else that sends email using your domain.
3. Look up your records. Google's free Check MX tool (opens in a new tab) checks your domain's mail settings and points out common problems.
4. Make a sender list. Write down every service that sends email as your domain. That list is your SPF and DKIM to-do list.
5. Watch your reputation if you send in volume. Google Postmaster Tools (opens in a new tab) shows how Gmail sees your mail, including your spam rate.

What Google and Yahoo require of bulk senders

If you send marketing email or high volumes of mail, here is the short version of what both providers publish:

• Set up SPF and DKIM for your sending domain.
• Publish a DMARC policy. A policy of none is enough to meet the requirement.
• Make sure the domain in your From line aligns with your SPF or DKIM domain.
• Give marketing and subscribed messages one-click unsubscribe, plus a visible unsubscribe link in the message.
• Honor unsubscribe requests quickly. Yahoo says within 2 days, and Google recommends within 48 hours.
• Keep your spam complaint rate below 0.3%. Google recommends staying below 0.1%.

Both providers also expect every sender to have valid forward and reverse DNS for sending servers, and Google requires a secure TLS connection. If you use a reputable email provider or marketing platform, many of these are handled for you, but the DNS records on your domain are still yours to set.

Why it matters for the rest of your business

Every app and automation you run depends on email arriving. Password resets and notifications from a client portal or custom app are useless in a spam folder. The same goes for the follow-ups, reminders, and invoices that business automation sends for you. Getting these three settings right is part of building systems that actually work.

What to do next

Run the Gmail test above today. It takes a few minutes and tells you right away whether you have a problem. If the results look confusing or something fails, book a free 30-minute intro call and a real person will help you make sense of it.