SPF, DKIM and DMARC Explained: Stop Your Company Emails Going to Spam
If customers say your quotations land in their spam folder, the cause is often missing email authentication records. Here is what SPF, DKIM and DMARC do and how to set them up.
By Friend Tech Team 2 min read
"Please check your spam folder" is not a message any business wants to send after emailing a quotation. When company emails are filtered as spam, the most common cause is not the content – it is that the receiving server cannot confirm the message really came from your domain. Three DNS records solve this: SPF, DKIM and DMARC.
SPF – who is allowed to send
SPF (Sender Policy Framework) is a TXT record on your domain that lists the services allowed to send email as you – for example Microsoft 365, Google Workspace, your website's contact form or an invoicing system. If an email arrives from a server that is not on the list, the receiver treats it with suspicion.
- Publish only one SPF record per domain; merge services into it rather than adding a second record.
- Include every system that sends email for you, including your POS or accounting software if it emails invoices.
DKIM – a digital signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The receiving server checks it against a public key published in your DNS. If the signature matches, the message was not altered and genuinely came from an authorised sender. Microsoft 365 and Google Workspace both generate DKIM keys that you publish and then switch on.
DMARC – the policy and the reports
DMARC tells receivers what to do when a message fails SPF and DKIM checks, and sends you reports about who is sending email using your domain. It has three levels:
- p=none – monitor only. Start here to see what is sending as your domain.
- p=quarantine – failing messages go to spam.
- p=reject – failing messages are blocked. This gives the strongest protection against people impersonating your company.
Major mailbox providers increasingly expect senders to have SPF, DKIM and DMARC in place, so these records are now a basic requirement rather than an extra.
A safe order to set them up
- List every system that sends email from your domain.
- Create or correct the SPF record.
- Enable DKIM in Microsoft 365, Google Workspace and any other sending service.
- Publish DMARC at p=none and review the reports for two to four weeks.
- Fix any legitimate senders that fail, then move to quarantine and finally reject.
Other reasons emails land in spam
- Sending from a free address while using your company name.
- A website contact form sending directly from the web server without authentication.
- Large attachments or links to unfamiliar file-sharing sites.
- A compromised mailbox sending spam, which damages your domain's reputation – multi-factor authentication helps prevent this.
Friend Tech configures SPF, DKIM and DMARC as part of every business email setup. See our business email packages or request a quote.