Two complaints come up again and again from small business owners. First, "our invoices keep going to customers' spam folders." Second, "someone sent an email that looked like it came from us." Both usually trace back to the same three DNS records: SPF, DKIM and DMARC.
You do not need to understand every technical detail. You do need to know what each record does, who should set them up, and why getting the order right matters.
Why this matters more now
Email was designed without any built-in way to prove who sent a message. Anyone can type your company name and address into the "from" line. Receiving mail systems now rely on SPF, DKIM and DMARC to decide whether a message claiming to be from your domain is genuine.
Gmail, Yahoo and Microsoft's consumer Outlook service have all tightened their rules. Senders of large daily volumes must have SPF, DKIM and DMARC in place, and every sender is expected to have at least basic authentication. Even if you only send a few hundred emails a day, missing records make it more likely your mail is filtered as spam or rejected.
SPF: the approved sender list
SPF (Sender Policy Framework) is a DNS record listing the services allowed to send email for your domain. Think of it as a guest list. When a message arrives, the receiving server checks whether it came from a server on the list.
Common problems we find:
- The list is missing a service that sends on your behalf, like your accounting software, CRM, newsletter tool or website form.
- There are two separate SPF records. You can only have one, so all senders must be combined.
- The record has grown too long. SPF has a limit on DNS lookups, and going over it causes failures.
DKIM: a tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message. The receiving server checks that signature against a public key published in your DNS. If it matches, the message really came from an authorized system and was not altered along the way.
Each sending service needs its own DKIM setup. Microsoft 365 and Google Workspace both support it, but it is not always switched on for your custom domain. Your marketing and billing platforms usually have their own DKIM steps, too.
DMARC: the policy and the reports
DMARC ties SPF and DKIM together. It tells receiving servers what to do when a message claims to be from your domain but fails the checks, and it sends you reports showing who is sending mail using your name.
DMARC has three policy levels:
- p=none: monitor only. Nothing is blocked, but you receive reports.
- p=quarantine: failing messages go to spam.
- p=reject: failing messages are refused outright.
Reject is what actually stops criminals from sending fake invoices that appear to come from your exact domain. It is a key defense against the scams described in our post on invoice fraud and business email compromise.
A safe order for setting them up
Jumping straight to a strict policy can block your own legitimate email. Follow this order instead:
- Inventory every system that sends as your domain. Email, billing, payroll, CRM, newsletters, website forms, scanners and any line-of-business software.
- Publish or fix a single SPF record that includes all of them.
- Turn on DKIM in your email platform and in each third-party service.
- Publish DMARC at p=none with a reporting address, and read the reports for a few weeks.
- Fix anything that fails. Reports often reveal a forgotten service or a vendor sending on your behalf.
- Move to p=quarantine, then to p=reject once reports look clean.
- Keep watching. When you add a new tool that sends email, update SPF and DKIM before it goes live.
What it will not fix
These records protect your own domain from being spoofed. They do not stop look-alike domains with a misspelling, and they do not help if a real mailbox is taken over. Strong passwords, MFA, email filtering and staff training cover those gaps. Deliverability also depends on content, sending reputation and list quality, so authentication is necessary but not the whole story.
Getting help
If your mail lands in spam or you are not sure what your DNS records say, our email security team can review SPF, DKIM and DMARC, read the reports and move you to enforcement safely. We also handle the Microsoft 365 side of the setup. We work with businesses across Los Angeles County, the Inland Empire and Ventura County.