SPF, DKIM and DMARC: Getting Your Business Email Delivered

A lead fills in your contact form, your website sends a notification, your CRM fires off a follow-up, and none of it lands in an inbox. For most small businesses the cause isn't the wording of the email. It's three DNS records that were never set up, or were set up once and then broken by the next tool someone connected. This is how I set up SPF, DKIM and DMARC for a small business, in the order I do it, with the mistakes I see most often.

I care about this because almost everything I build sends email. Websites send form notifications, the lead follow-up systems I describe in how to automate lead follow-up send replies within minutes, and the AI automation work on sites like Wintech Studios is built around answering every lead quickly. A fast reply that goes to spam is the same as no reply.

What SPF, DKIM and DMARC each prove

These three are often described as one thing. They aren't. Each answers a different question, and you need all three to tell a receiving mail server the full story.

The key idea is that SPF and DKIM can both pass while DMARC still fails. That happens when a newsletter tool authenticates mail as its own domain rather than yours. The receiving server sees a valid signature, just not one from the business whose name is in the From line.

What Gmail, Yahoo and Outlook now require

The big mailbox providers stopped treating authentication as optional. Google's email sender guidelines say that since February 1, 2024 everyone sending to Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS for sending IPs, use TLS, and keep the spam rate reported in Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC, align the From domain with SPF or DKIM, and support one-click unsubscribe on marketing mail.

Yahoo's sender requirements follow the same shape: SPF or DKIM and a spam rate below 0.3% for everyone, and for bulk senders both SPF and DKIM, a valid DMARC policy of at least p=none, From domain alignment, one-click unsubscribe, and unsubscribes honored within 2 days. Microsoft's Outlook announcement applies the same idea to domains sending over 5,000 messages a day to Outlook.com, Hotmail and Live.com addresses, with enforcement starting May 5, 2025. Its support page for the bounce shows the result: "550 5.7.515 Access denied, sending domain does not meet the required authentication level."

Most small businesses never get near 5,000 messages a day, so on paper they only need SPF or DKIM. I set up all three anyway, and so does Google: the same page says it recommends always setting up SPF, DKIM and DMARC. The bulk rules are where providers are heading, and DMARC is the only one of the three that stops someone else sending invoices "from" your domain.

Step 1: List every service that sends as your domain

Skipping this step is how businesses lock out their own mail. Before touching DNS, write down everything that sends email with your domain in the From line. For a typical small business that list looks like this:

• Your mailbox provider, usually Google Workspace or Microsoft 365
• The website: form notifications, password resets, order confirmations
• The CRM and any lead follow-up automation
• A newsletter or marketing platform
• Invoicing, accounting or payment tools that email receipts
• Booking, scheduling, helpdesk or review request tools

Check each tool's settings for "domain authentication" or "sending domain". Anything you miss shows up later in DMARC reports, but it's better to find it now.

Step 2: Publish one SPF record, and keep it under 10 lookups

SPF is a list of servers allowed to send for your domain. A small business record often looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Two rules in the SPF specification, RFC 7208 cause most of the failures I see. First, a domain gets one SPF record. If a lookup finds more than one record starting with v=spf1, the result is a permerror, which receivers treat as broken. When a new tool tells you to "add this SPF record", you merge its include into your existing record instead of creating a second one.

Second, the spec caps the terms that trigger DNS lookups, meaning include, a, mx, ptr, exists and redirect, at 10 per evaluation, and going over also returns permerror. Every include can contain more includes inside it, so four or five tools can quietly push you over. If you hit the limit, drop tools you no longer use, and move marketing mail to a subdomain with its own SPF record rather than cramming everything onto the root.

At the end, ~all means "probably not us" and -all means "definitely not us". I start with ~all while DMARC reports are coming in, because DMARC is what decides the outcome later anyway.

Step 3: Turn on DKIM for every sender

DKIM adds a cryptographic signature to each message, and the public key sits in your DNS. Each sending service gets its own selector, so you can have Google Workspace, your CRM and your newsletter tool all signing at once without conflict. Most platforms give you two or three CNAME records to add, then a "verify" button.

Google notes that sending to personal Gmail accounts needs a DKIM key of at least 1024 bits and recommends 2048 bits where your provider supports it, in the same sender guidelines. Yahoo's best practices also ask for a minimum of 1024 bits. If your setup screen offers 2048, pick it.

The important detail: turn on custom domain signing in each tool. Many platforms sign with their own domain by default. That passes DKIM, but it doesn't align with your From address, so it won't help DMARC.

Step 4: Publish DMARC at p=none, then read the reports

DMARC is one TXT record at _dmarc.yourdomain.com. The first version I publish is almost always this:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none tells receivers not to change how they handle failing mail, and rua tells them where to send aggregate reports. Yahoo's sender page strongly recommends the rua tag during initial setup for exactly this reason. Those reports are XML files listing which servers sent mail as your domain and whether each passed. They're unreadable raw, so I send them to a free or low-cost DMARC report tool that turns them into a list of senders.

Give it two to four weeks so monthly mail like invoices shows up, then review every failing source. Each one is either a tool you forgot in step 1, which needs SPF or DKIM fixed, or someone impersonating you, which is the reason you're doing this at all.

Once the legitimate sources all pass, move to p=quarantine, which asks receivers to treat failing mail as suspicious, and later to p=reject, which asks them to refuse it. Both values are defined in the p tag section of RFC 9989.

Alignment, the part that trips people up

Every email has two "from" addresses: the one people see, and a technical return address used for bounces. SPF checks the technical one. DMARC asks whether the domain that passed SPF or DKIM matches the visible From domain. That match is alignment, and both Google and Yahoo require it for bulk senders.

Under relaxed alignment, the default for both the adkim and aspf tags in RFC 9989, a subdomain like mail.yourdomain.com counts as aligned with yourdomain.com. That's why most email platforms ask you to set a custom return path or "link branding" on a subdomain of yours. Without it, SPF passes for the platform's domain, not yours, and DMARC fails.

In my experience DKIM is the more reliable of the two for alignment, because SPF breaks when mail is forwarded and DKIM usually survives. If I can only get one aligned for a stubborn tool, I make it DKIM.

When not to go to p=reject

Reject is the goal for most businesses, but not on a deadline. I hold off when:

• The reports still show legitimate senders failing. Reject will bounce your own invoices.
• Staff rely on mailing lists or forwarding. Some lists change messages in ways that break DKIM, and forwarding breaks SPF. Quarantine is a safer resting point until you know how that mail behaves.
• Nobody is going to watch the reports. A strict policy with no one monitoring means the first sign of a new broken tool is a customer saying they never got your email.

The opposite case is a domain that never sends email at all, like an old brand name you still own. Those can go straight to v=spf1 -all and v=DMARC1; p=reject, because there's no legitimate mail to break and they're easy targets for spoofing.

How to check it's working

Send a test email from each tool to a personal Gmail and an Outlook address, then open the full message headers. Look for the Authentication-Results line and you want three results: spf=pass, dkim=pass with your domain, and dmarc=pass.

If mail starts bouncing, the error code tells you who is unhappy. Google's sender guidelines say unauthenticated mail may be marked as spam or rejected with a 5.7.26 error, and Microsoft uses 5.7.515 for high-volume senders failing its checks. Both point to authentication, not content. It's also worth signing up for Google Postmaster Tools if you send enough mail to show data there, since the guidelines measure the 0.3% spam rate limit using the rate reported in Postmaster Tools.

The setup checklist

1. List every service that sends as your domain.
2. Merge them into one SPF record, under 10 DNS lookups, ending in ~all.
3. Turn on custom domain DKIM in every tool, 2048-bit where offered.
4. Set a custom return path or link branding domain in each email platform.
5. Publish v=DMARC1; p=none; rua=mailto:... and route reports to a reader.
6. After two to four weeks, fix or remove every failing legitimate source.
7. Move to p=quarantine, watch for a few weeks, then p=reject.
8. Lock down domains that never send with -all and p=reject.
9. Retest headers every time a new tool starts sending.

DNS is also part of the broader site health work I cover in the technical SEO checklist for small businesses, and the two usually get audited together, since both live with whoever controls the domain.

Frequently asked questions

Do I need DMARC if I send fewer than 5,000 emails a day?

Gmail and Yahoo only require SPF or DKIM below that volume. But Google's guidelines recommend all three for every domain, and without DMARC there's nothing telling receivers to distrust someone spoofing your domain. A p=none record with reporting takes a few minutes to add and costs nothing.

Will setting up SPF, DKIM and DMARC get me out of the spam folder?

It removes one of the main reasons mail gets filtered, but it isn't the whole picture. Gmail and Yahoo both tie delivery to spam complaints too, with a 0.3% ceiling in the Google and Yahoo rules. Authentication proves the mail is really from you; people still have to want it.

Should my marketing email go out from a subdomain?

Often, yes. Yahoo's best practices say to segregate marketing mail from transactional and user mail by IP or DKIM domain, because each IP and DKIM domain has its own reputation. A subdomain like news.yourdomain.com keeps a bad campaign from dragging down your invoices and form notifications, and it gives you a fresh SPF lookup budget.

Who should own these records?

Whoever controls your DNS, plus someone who reads the DMARC reports. In many small businesses those are two people who never talk, which is how a new tool gets added unchecked.

If your form notifications or follow-ups are going missing, or you're not sure who set up your DNS, send me your domain and what tools send email for you. I'll tell you what's passing, what's failing and what to fix first. You can also see what else I set up during a build on my services page.