If your emails are landing in spam, bouncing, or getting quietly filtered before a customer ever sees them, the most common cause isn’t your email provider — it’s missing or misconfigured DNS records. SPF, DKIM, and DMARC are the three protocols mailbox providers use to decide whether an email claiming to be from your domain is genuinely from you. Get them right and your mail reaches the inbox. Get them wrong, or leave them half-configured, and you’re fighting deliverability problems that look like a hundred different issues but trace back to one root cause.
What Each Protocol Actually Does
SPF (Sender Policy Framework) is a DNS record listing which mail servers are allowed to send email on behalf of your domain. When a receiving server gets a message, it checks whether the sending server is on that list. No match, and the message looks like spoofing.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail, generated from a private key only your mail system holds. The receiving server checks that signature against a public key published in your DNS. If the message was altered in transit, or wasn’t actually signed by you, the check fails.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receiving servers what to do when a message fails SPF or DKIM alignment — do nothing (p=none), quarantine it, or reject it outright — and it gives you reporting so you can see who’s sending mail as your domain, including anyone spoofing you.
Why Half-Configured Is Worse Than You’d Think
The most common mistake we see isn’t a missing record — it’s an incomplete one. A business adds SPF for their main mail server but forgets to include their marketing platform or CRM’s sending servers, so campaign emails fail SPF. Or DKIM gets set up correctly but DMARC is left at p=none indefinitely, which reports on problems but never actually stops spoofed mail from reaching inboxes under your name.
Each time you add a new tool that sends email on your behalf — a CRM, a transactional email service, a marketing automation platform — it needs to be added to your SPF record and, ideally, configured for DKIM signing too. This is the step that gets missed as businesses adopt more tools over time, and it’s why deliverability tends to quietly degrade rather than break all at once.
Getting From p=none to Real Protection
The safe rollout order is SPF first, then DKIM, then DMARC starting at p=none so you can monitor reports without risking legitimate mail getting blocked by a mistake in your own setup. Once the reports show your legitimate senders are all passing cleanly, move DMARC to p=quarantine, and eventually p=reject once you’re confident nothing legitimate is being missed. Skipping straight to enforcement without that monitoring period is how businesses accidentally block their own transactional emails.
How Tim’s Web Worx Helps
We set up and audit SPF, DKIM, and DMARC as part of hosting and email configuration for our clients — checking not just whether records exist, but whether every tool actually sending mail on your behalf is properly authorised. If your emails have been landing in spam or you’re not sure your setup is complete, get in touch and we’ll check it for you.
