When a business says customers are not getting its emails, the cause is often the mail setup rather than the message itself. Receiving mail servers decide whether to trust a message based on three DNS records: SPF, DKIM and DMARC. The names sound technical, and the records do take some care, but the ideas behind them are simple. Each one answers a question the receiving server is asking about your mail.
SPF: The List of Approved Senders
SPF is a DNS record that lists the servers allowed to send mail for your domain. Mail for a small business often comes from more places than the owner expects: the office email service, the website’s contact form, a newsletter tool, the phone system’s voicemail-to-email feature and an invoicing program. Each sender that goes out under your domain needs to be on the list. SPF also limits how many lookups it can make, so adding every tool without thought can break the record. I keep a single SPF record and review it whenever a new sender is added.
DKIM: The Signature on Each Message
DKIM signs outgoing messages with a private key that only your sending service holds. The matching public key is published in DNS, and the receiving server uses it to confirm the signature. Each sending service has its own key, usually identified by a selector name. You turn DKIM on in the provider’s admin panel and publish the record the provider gives you. If a message is altered in transit, or was sent by something without the key, the check fails.
DMARC: The Policy That Ties Them Together
DMARC is the record that tells receiving servers what to do when SPF and DKIM fail, and where to send reports about those failures. The policy can be set to none, quarantine or reject. I start every domain at none, which only monitors. The reports show which senders are passing and which are not, and they often reveal a forgotten tool sending mail under the business name. Only after those reports look clean do I move toward quarantine and then reject.
The Order I Use
The sequence matters. First, list every service that sends mail for the domain. Second, correct the SPF record so it includes each one. Third, enable DKIM for each sender and publish its key. Fourth, publish a DMARC record set to none. Fifth, read the reports for several weeks. Only then tighten the policy. Skipping straight to reject before the reports are read is the fastest way to block your own invoices.
Replies deserve their own check. Send a message from a staff mailbox to a personal address you can read on a phone, then look at the security details your mail app shows for the message. Many apps display a warning or a verified indicator when authentication passes, and the difference is easy to spot once you know where to look. Do this for each sending tool, not only the office email, because the contact form and the phone system often send through different paths. A test takes a few minutes and tells you more than the records alone.
Mistakes I See Most Often
Two SPF records on the same domain is the most common error. Receiving servers treat that as a failure, and many people publish a second record without realizing the first one exists. The next is forgetting the website’s contact form, so the business’s own notifications start landing in spam. The third is changing a DNS record and assuming the change is finished the moment it is saved. DNS changes can take time to spread, so test after a short wait rather than immediately.
How to Check Your Own Domain
Several free lookup tools show the SPF, DKIM and DMARC records published for a domain. Start by looking up the records, then compare them with the list of senders you wrote down. Ask each provider for its DKIM setup instructions if you cannot find them. If the list is longer than you expected, that is useful information in itself.
If you want someone to check the records alongside the rest of your business technology, the office in the cloud page describes how DirecTech brings phones, IT support and your website together with one provider. Ask whoever manages your mail to show you the current records and the list of services that send under your domain. Keeping that list current is most of the work.
Danielle Lemons is Vice President of Operations at DirecTech Connect, where she oversees phone, IT and support operations for small and mid-sized businesses. You can also find her work at daniellelemons.com.
