Email Deliverability: SPF, DKIM and DMARC Explained for Business Leaders

Invoices that never arrive, proposals stuck in spam folders and fraudsters sending email that appears to come from your company: all three problems often trace back to missing email authentication. Three DNS records, SPF, DKIM and DMARC, address them.

SPF: who may send for your domain

Sender Policy Framework is a DNS record listing the servers allowed to send email on behalf of your domain, such as your email provider and your marketing platform. Receiving servers check it to spot unauthorised senders.

DKIM: proof the message was not altered

DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. The receiver uses a public key in your DNS to confirm the email genuinely came from your domain and was not modified in transit.

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting and Conformance tells receiving servers how to treat messages that fail SPF or DKIM: deliver them, quarantine them, or reject them. It also sends you reports showing who is sending email using your domain.

Why it matters more now

Major mailbox providers, including Gmail, Yahoo and Outlook.com, have tightened requirements for senders, particularly those sending in volume. Authenticated domains are far more likely to reach the inbox, and DMARC enforcement makes your domain much harder to impersonate in phishing attacks.

A safe rollout

1. Inventory every service that sends email as your domain: email suite, CRM, website forms, invoicing tools.
2. Publish an SPF record that includes all of them.
3. Enable DKIM signing in each sending service.
4. Start DMARC in monitoring mode (p=none) and review reports for a few weeks.
5. Move gradually to quarantine and then reject once legitimate senders all pass.

This is a small technical task with an outsized impact on reliability and brand protection.