Email Deliverability: SPF, DKIM and DMARC Explained for Small Firms
If your quotes and invoices land in spam, the problem is probably not your wording. Three DNS records decide whether receiving mail servers trust you.
Email deliverability is one of those problems that stays invisible until a customer says they never received your quote. By then, the message has usually been sitting in a spam folder for days. Mailbox providers have become strict about who may send mail from a domain, and the rules are enforced by three technical records that most small businesses have never looked at. Understanding them takes ten minutes and can rescue a great deal of lost correspondence.
Why anyone can pretend to be you
Email was designed in an era of trust. Nothing in its original design stopped a stranger from sending a message that claimed to come from your address. Criminals exploit this to send fake invoices in your name, and receiving servers, trying to protect their users, have learned to look for proof that a message really came from where it says. The records that provide that proof live in your domain's DNS settings.
SPF: who may send for you
A Sender Policy Framework record is a published list of the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from one of them. The common mistake is forgetting a service: the website's contact form, the invoicing software, the newsletter tool and the helpdesk all send mail, and each must be included. A domain can only have one SPF record, and it has a limit on lookups, so keep it tidy.
DKIM: a signature on every message
DomainKeys Identified Mail adds a cryptographic signature to each outgoing message. The matching public key sits in your DNS, so the recipient can check that the message was genuinely authorised and was not altered on the way. Your email provider and each sending service will give you a record to publish. Without it, messages are more likely to be treated with suspicion.
DMARC: what to do when checks fail
A DMARC record ties the two together and tells receivers what to do with mail that fails: do nothing but report, put it in quarantine or reject it. It also asks for reports, which show who is sending mail in your name. The safe approach is to start in monitoring mode, read the reports for a few weeks, fix any legitimate sender that is failing and then tighten the policy gradually. Jumping straight to rejection can block your own invoices.
The big providers raised the bar
Since early 2024, Google and Yahoo have required senders of large volumes of mail to authenticate with SPF and DKIM, publish a DMARC policy and offer easy unsubscription. Even if you send only a few hundred messages, following the same practices improves your chances of reaching the inbox. Marketing messages need clear unsubscribe links and, under UK rules, a lawful basis such as consent or a valid soft opt-in.
Check your own domain
Send a message from your business address to a free mailbox and look at the message headers, which show whether SPF, DKIM and DMARC passed. Several free online checkers will test a domain and list problems. Test every system that sends on your behalf, including the website, not just your normal email account.
Habits that protect your reputation
Mistakes we see most often
Two SPF records on one domain, which invalidates both. A website form that sends mail from a free webmail address, which fails the checks. A newsletter tool that was never added to the list of permitted senders. A DKIM key that was never switched on after the email provider was changed. And a DMARC policy set to reject on day one, which stops legitimate messages from the accounts package. Each is easy to fix once you know where to look.
Keep a register of senders
Write down every system that sends email in your name, who owns it and where its settings live. Review the list when you adopt a new tool, and again every six months. When someone leaves or a supplier changes, the register shows which records need updating. It also makes the monthly DMARC reports far easier to interpret.
Keep your lists clean, remove addresses that bounce, avoid sending large attachments or messages made of a single image, and do not buy mailing lists. Use a separate subdomain for bulk mail so that a problem there does not harm your day-to-day correspondence. If you would like help setting up or auditing these records, we do it routinely and can usually report back within a day.