InfinityInbay
PL Describe the problem

Why company emails end up in spam: SPF, DKIM and DMARC in plain words

In short

SPF says which servers may send email from your domain, DKIM signs every message, and DMARC tells recipients what to do with an email that fails those checks. Without these three DNS records, emails end up in spam more often, and a scammer can send a message that looks as if it came from you.

Author: Grzegorz PawlakUpdated: Reading time: 3 minCategory: Security and infrastructure
Key points
  • These are three records in the domain's DNS, set once and checked after every change of email services.
  • Large email providers require them from senders more and more strictly.
  • DMARC is rolled out gradually: first reports only, then quarantine, finally rejection.
  • Every service that sends email on your behalf (newsletter, invoicing system, shop) must be in SPF and have DKIM.
HomeWebsitesAppsAboutKnowledgeServicesProcess automationCustom softwareAI implementationIT infrastructureProjectsHow I workContact

You are here: Knowledge.

Three records, three questions

SPF

Is the server that sent this email allowed to send on behalf of this domain? The record is a list of allowed servers.

DKIM

Was the email's content changed on the way, and does it really come from this domain? The mail server signs every message with a key, and the public key is in DNS.

DMARC

What to do with an email that passed neither SPF nor DKIM, and where to send reports about such emails?

Example records

This is what the records can look like for a domain that sends email through one provider. Your email provider gives the exact SPF value and the DKIM record in its documentation.

DNS records (example)
; SPF: only the email provider's servers may send email from the domain
company.com.            TXT  "v=spf1 include:_spf.mail-provider.com -all"

; DKIM: the public key given by the provider (the selector name comes from the provider too)
selector._domainkey.company.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

; DMARC: stage 1, reports only, no effect on delivery
_dmarc.company.com.     TXT  "v=DMARC1; p=none; rua=mailto:dmarc@company.com"
Caution

A domain can have only one SPF record. When you add another service that sends email, you add it to the existing record instead of creating a second one. Two SPF records are an error that makes both stop working.

A safe DMARC rollout, step by step

  1. List every service that sends email from the domain

    Employees' mailboxes, the newsletter, the invoicing system, the shop, the website form, the CRM. It's easy to forget one.

  2. Set up SPF and DKIM for each of them

    Every service has instructions in its documentation. Check sending with a test email.

  3. Turn on DMARC with p=none

    Emails arrive as before, and you get reports on who sends on behalf of your domain.

  4. Review the reports for a few weeks

    If you see one of your services failing the checks, fix its configuration. If you see unknown servers, those are spoofing attempts.

  5. Tighten the policy

    First p=quarantine (suspicious mail to spam), and when everything is clean, p=reject (suspicious mail rejected).

Tip

DMARC reports are XML files that aren't very readable for people. There are free and paid tools that turn them into clear summaries.

Terms from this guide

SPF

A DNS record listing the servers allowed to send email on behalf of a domain.

DKIM

A digital signature the mail server adds to every email. The recipient checks it with the public key stored in the domain's DNS.

DMARC

A DNS record that tells recipients what to do with an email that fails SPF and DKIM, and where to send reports.

Questions and answers

How do I know whether my domain has these records?

The simplest way is a free DMARC and SPF testing tool, or send an email to a Gmail mailbox and use “Show original” to see the SPF, DKIM and DMARC results.

Is this enough to keep emails out of spam?

It's the foundation, without which it's much harder. Content, domain reputation and whether recipients mark messages as spam also play a part.

Can p=reject block my own emails?

Yes, if one of the services sending on your behalf doesn't have correct SPF or DKIM. That's why p=none and reports come first, and tightening only after checking.

Sources and documentation

The service related to this guide

IT infrastructure and server administration

See the serviceDescribe the problem

Related guides

Security and infrastructure

Company website security: 12 things to check in an hour

3 min · checklistSecurity and infrastructure

Backups in a small business: the 3-2-1 rule and restore tests

4 min · checklistSecurity and infrastructure

Sign-in with the company account in an internal app: Active Directory step by step

5 min · checklist

Describe the problem

Question 1 of 5

What would you most like to improve?

Pick the closest one. It doesn't have to fit perfectly.

First summary

This is a first suggestion based on a few answers, not a diagnosis. Nothing is saved until you send the message.