Email Deliverability: SPF, DKIM and DMARC Made Simple

You send an important email to a customer. A quote, an invoice, a reply they have been waiting for. Hours pass. Then a day. Eventually they message you on another channel: "I never got your email." You check your sent folder, and there it is, sent successfully. So where did it go? Most likely, it slipped into a spam folder, or it was quietly rejected before it ever arrived. This frustrating, invisible failure has a name: poor email deliverability.

The good news is that deliverability is not luck. It is governed by three small but powerful settings with intimidating names: SPF, DKIM and DMARC. Once they are in place, your emails are far more likely to reach the inbox, and impostors find it much harder to send fake messages pretending to be you. This guide explains all three in plain language, why they exist, and how to set them up without needing a technical background.

Why email needs protecting at all

Email was invented in a more trusting era. The original design let anyone claim to be sending from any address, a bit like posting a letter with someone else's name in the return corner. That openness made email wonderfully flexible, but it also made it easy to abuse. Scammers send billions of fake messages every day, many pretending to come from real businesses. To fight back, mailbox providers built a system of checks that ask a simple question: can this sender prove they are who they claim to be?

SPF, DKIM and DMARC are how you answer "yes" to that question. They are the difference between an email that sails into the inbox and one that gets flagged, filtered, or binned. They all live as records in your domain's DNS settings, so if that term is new to you, our guide on DNS records explained for non-technical owners is the perfect place to start, and domain renewal and DNS basics covers where these settings live.

SPF: the guest list

SPF stands for Sender Policy Framework, but it is easier to think of it as a guest list. It is a record you publish that says, in effect, "these are the servers allowed to send email on behalf of my domain." When a message arrives, the receiving server checks whether it came from a server on your list. If it did, the email passes the SPF check. If it did not, the message looks suspicious.

The practical catch is that many businesses send email from more than one place: their main email service, a newsletter platform, an invoicing tool, a support desk. Every one of those needs to be included in your SPF record, or its messages may fail the check. A common reason good email gets filtered is simply that a new tool was added without updating SPF. Keeping this list current is a small but real part of ongoing looking after your online presence over time.

DKIM: the tamper-proof seal

DKIM stands for DomainKeys Identified Mail. If SPF is a guest list, DKIM is a wax seal on the envelope. When you send a message, your email service adds a hidden digital signature created with a secret key that only you hold. The receiving server checks that signature against a matching public key you have published in DNS. If the signature is valid, two things are proven: the message genuinely came from your domain, and it was not altered along the way.

This matters because it makes forgery dramatically harder. An impostor might be able to fake your address in the "from" line, but they cannot forge your DKIM signature without your secret key. Most reputable email providers can set DKIM up for you with a few clicks, generating the keys and telling you exactly which DNS record to add.

DMARC: the rulebook and the report

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It ties the other two together and does two valuable things. First, it tells receiving servers what to do with messages that fail SPF and DKIM checks: let them through, send them to spam, or reject them outright. Second, it sends you reports showing who is sending email using your domain, including any impostors. That visibility alone is worth the effort.

DMARC is usually introduced gently. You start in a "monitor only" mode that changes nothing but collects reports, so you can see your real email landscape without risk. Once you are confident every legitimate sender is passing, you tighten the policy to quarantine or reject. Rushing straight to a strict policy is the classic mistake that accidentally blocks your own newsletters.

Why this protects your reputation, not just your inbox

There is a bigger picture here. When scammers successfully impersonate your domain, the damage is not only to the people they fool. Every fraudulent message sent in your name chips away at your domain's reputation, the invisible score mailbox providers use to decide whether to trust you. A damaged reputation means even your honest emails start landing in spam. Setting up these three records is therefore a form of brand protection, much like keeping your website secure and trustworthy. It sits comfortably alongside other trust signals such as your SSL certificate and the padlock in the browser.

A sensible order to set things up

If you are starting from scratch, work through them in this order. Begin with SPF, listing every service that sends email for you. Next, enable DKIM through each of your email providers, adding the keys they give you. Finally, publish a DMARC record in monitoring mode and read the reports for a few weeks. Only then should you tighten the policy. Taking it step by step means you never block your own messages, and you build a clear picture of who is using your domain.

Keep a list of your senders

The most useful document you can keep is a simple list of every tool and service that sends email on your behalf. New platforms get added to a business all the time, and each one is a potential deliverability problem if it is not authorised. Reviewing this list when you add or remove tools turns email security into a quiet routine rather than an emergency. This kind of housekeeping pairs well with regular monitoring of your wider online services.

When to get expert help

For a small business with one email provider, setting up SPF, DKIM and DMARC is very achievable in an afternoon. For a business sending from many platforms, interpreting DMARC reports and tuning policies can get fiddly, and the stakes are high because a mistake can stop your email reaching anyone. If it feels daunting, it is entirely reasonable to have someone configure it correctly once and then hand it back to you to maintain. You can reach out to a team that handles email authentication for businesses if you would rather not navigate the reports alone. Either way, getting these three records right is one of the highest-value things you can do for your communication.

Frequently asked questions

References

1. Internet Engineering Task Force. "Domain-based Message Authentication, Reporting, and Conformance (RFC 7489)." ietf.org.
2. Google. "Email sender guidelines, Workspace Help." google.com.
3. Cybersecurity and Infrastructure Security Agency. "Enhance Email and Web Security." cisa.gov.