A customer says your quote "never arrived". It's in their spam folder — again. For most small businesses the cause is the same: the domain's email authentication isn't set up. Three DNS records — SPF, DKIM and DMARC — tell receiving mail servers your emails are genuine.
Why It Matters More Now
In 2024 Google and Yahoo tightened their rules for anyone sending email to their users. Google's email sender guidelines require all senders to use SPF or DKIM, and bulk senders to use all three plus an easy unsubscribe. Even if you only send a few emails a day, proper authentication is now the difference between the inbox and the spam folder.
SPF: Who's Allowed to Send
SPF (Sender Policy Framework) is a DNS record listing the services allowed to send email for your domain — for example Google Workspace, Microsoft 365, and your newsletter tool. A receiving server checks whether the email came from an approved source.
Common mistake: having two SPF records (for example one added by your email provider and one by your newsletter tool). You must have exactly one, combining all senders.
DKIM: A Tamper-Proof Signature
DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The receiving server checks it against a public key in your DNS, proving the message really came from your domain and wasn't altered in transit. You switch it on in Google Workspace or Microsoft 365, then add the DNS record they give you.
DMARC: What to Do With Failures
DMARC tells receiving servers what to do with emails that fail SPF and DKIM checks — deliver them, quarantine them, or reject them — and sends you reports about who's sending email using your domain. That last part is how you spot someone impersonating your business.
Start with a monitoring policy, review the reports for a few weeks, then tighten it:
p=none— monitor only.p=quarantine— failing emails go to spam.p=reject— failing emails are refused. The strongest protection against spoofing.
Setting It Up
Google Workspace
Add Google to your SPF record, generate a DKIM key in the Admin console under Gmail → Authenticate email, publish it in DNS, then add a DMARC record. See our Google Workspace setup service.
Microsoft 365
Add Microsoft to your SPF record, enable DKIM in the Microsoft Defender portal (it gives you two CNAME records), then add DMARC. See Microsoft 365 setup.
Choosing between the two? Read Google Workspace vs Microsoft 365.
Don't Forget Other Senders
Your website's contact form, invoicing software, CRM and newsletter tool all send email "from" your domain. Each needs to be included in SPF or set up with its own DKIM, or those emails will fail DMARC once you tighten the policy.
Emails still going to spam? We set up and fix email authentication as part of our Google Workspace and Microsoft 365 services — get in touch.