Last updated:
Three DNS records decide whether your email arrives in your customers' inboxes or quietly lands in spam. Most small businesses have one of them at best. They take an afternoon to set up properly, and they make more difference to deliverability than anything else you can do.
Why receiving servers are suspicious
Email was designed in an era when nobody pretended to be anyone else. Anyone can send a message that claims to be from your domain. Gmail, Outlook and every other mail provider know this, so they look for proof that a message really came from you. SPF, DKIM and DMARC are that proof. Without them, your genuine email looks no different from a forgery.
SPF: who is allowed to send as you
An SPF record is a single line of text in your domain's DNS. It lists the servers that are allowed to send email for your domain. When a message arrives claiming to be from you, the receiving server checks whether it came from one of those servers.
The common mistake is forgetting a sender. If your mailboxes are with one provider, your website's contact form sends from your hosting server and your newsletters go out through a mailing service, all three need to be in your SPF record. Anything left out is treated as suspect.
You can only have one SPF record per domain. If you need to add a sender, edit the existing record rather than creating a second one, because two SPF records make both invalid.
DKIM: a signature that can't be forged
DKIM adds a digital signature to every message you send. The matching public key sits in your DNS, so the receiving server can check that the message really came from your mail provider and wasn't altered on the way. Your email provider generates the key; you publish it as a DNS record.
DMARC: what to do when the checks fail
DMARC tells receiving servers what to do with a message that fails SPF and DKIM: let it through, put it in spam, or reject it. It also asks them to send you reports, which show who is sending email using your domain. That's often the first sign that someone is impersonating your business.
Start gently. A DMARC policy of p=none changes nothing about delivery; it just switches the reports on. Once the reports show that all your genuine email passes, you can tighten the policy to quarantine and then reject.
How to check what you have
Free tools such as MXToolbox will look up your SPF, DKIM and DMARC records and tell you what's missing. Or send an email to a Gmail address, open it, and choose Show original. Gmail lists a PASS or FAIL for each of the three.
If your email is with us
If your mailboxes are on our Professional Email service, your SPF record needs to include our mail servers. If you don't send email from anywhere else, it should read:
v=spf1 include:spf.cloudus.rs.oxcs.net ~all
If you also send from another service, such as a newsletter platform, add its include: to the same record, before the ~all.
For DMARC, a sensible first record is a TXT record named _dmarc containing:
v=DMARC1; p=none; rua=mailto:[email protected]
Be warned that the reports can arrive in large numbers, one from each mail provider every day. Send them to an alias set up for the purpose, or to a free DMARC report service that summarises them, rather than to a mailbox you read every day. If you'd rather not deal with reports at all, v=DMARC1; p=none; on its own is still worth having.
Not sure what you have, or want us to check? Open a ticket with your domain name and we'll take a look.