If your business email is landing in spam — or someone is impersonating your domain to send fraudulent emails — the root cause is almost always missing DNS authentication records. SPF, DKIM, and DMARC are three DNS TXT records that together tell receiving mail servers: "This email is genuine." Without them, your deliverability suffers and your domain reputation is at risk.
What's at Stake Without Them
In early 2024, Google and Yahoo officially mandated that high-volume senders configure all three records. Even for smaller senders, missing these records increasingly causes legitimate emails to be filtered. Practical consequences: client quotes never arrive, invoice emails get blocked, and your domain could be used by spammers without your knowledge.
The Three Records Explained
SPF — Sender Policy Framework
A DNS TXT record that lists which mail servers are authorised to send from your domain. Without it, any server worldwide can send email claiming to be from you@yourbusiness.com.
↑ This example authorises Google Workspace to send on your behalf.
DKIM — DomainKeys Identified Mail
DKIM adds a cryptographic signature to every email you send. The receiving server verifies this signature using a public key published in your DNS — proving the email wasn't tampered with in transit. It's the strongest inbox-delivery signal of the three.
DMARC — Domain-Based Message Authentication
DMARC ties SPF and DKIM together and tells receiving servers what to do with emails that fail authentication — and sends you weekly reports on who is sending mail from your domain.
↑ Use p=reject for maximum protection once the other two records are confirmed working.
Quick Test: Are Your Records Working?
Send an email from your business domain to a Gmail address. In Gmail, click the three-dot menu → "Show original." Look for:
dkim=pass spf=pass dmarc=pass
If any show "fail" or are missing, your configuration needs work. Use MXToolbox Email Health for a free full diagnostic.
Implementation Order
- SPF first — a single TXT record, no risk of breaking existing mail flow.
- DKIM second — generated in your email provider's admin panel. Allow 24–48 hours to propagate.
- DMARC last — start with
p=nonefor 2–4 weeks, review reports, then enforce.
Let Us Configure This For You
Our Business Email Setup service includes full SPF, DKIM, and DMARC configuration as standard — your emails land in inboxes from day one.
See the Service →