SPF, DKIM and DMARC in Plain English: Why Your Business Email Lands in Spam

A customer swears they never got your quote. Your website's contact form "works," but nothing reaches your inbox. Your newsletter's open rate drops by half overnight. Often the cause isn't your message at all. It's that your domain can't prove the email really came from you.

The short answer: SPF, DKIM and DMARC are three short text records added to your domain's settings. Together they tell email providers which services are allowed to send mail as your business, prove that messages weren't altered along the way, and say what to do with mail that fails those checks. Google, Yahoo and Microsoft now require them from anyone sending in bulk, and Google requires at least SPF or DKIM from every sender. Setting them up is usually an hour or two of careful work, and it also makes it much harder for scammers to send email pretending to be you.

Why this suddenly matters

For years, these records were optional extras that large companies set up and small businesses ignored. That changed when the big mailbox providers started enforcing them.

• Google requires every sender to Gmail to set up SPF or DKIM. Senders of more than 5,000 messages a day must have SPF, DKIM and DMARC. Google began enforcing these rules in 2024 and has been tightening enforcement since, moving from temporary delays to outright rejections for mail that doesn't comply.
• Yahoo has the same split: SPF or DKIM for everyone, and SPF, DKIM, a passing DMARC record and one-click unsubscribe for bulk senders.
• Microsoft began enforcing similar rules for high-volume senders to Outlook.com, Hotmail and Live addresses on May 5, 2025. Mail that fails can be junked or rejected outright.

Your business probably doesn't send 5,000 emails a day. It doesn't matter as much as it sounds. Your newsletter platform pools your mail with other customers', the bulk thresholds count all of your domain's mail together, and providers increasingly treat unauthenticated mail from any sender with suspicion. The safe assumption in 2026 is that every business domain needs all three.

It also protects your customers

Authentication isn't only about getting your mail delivered. It's about stopping someone else from sending mail that looks like yours.

Business email compromise, where criminals impersonate a company or an executive to redirect payments, is one of the costliest crimes the FBI tracks. Its Internet Crime Complaint Center received 21,442 business email compromise complaints in 2024, with losses close to $2.8 billion, and nearly $8.5 billion over the three years from 2022 through 2024.

A DMARC record set to quarantine or reject tells Gmail, Outlook and others to stop mail that claims to come from your domain but doesn't. It won't stop every scam, since criminals can still register look-alike domains, but it closes the easiest door. For older customers, who are frequent targets of impersonation scams, that protection matters even more, as we cover in designing websites for older adults.

Adoption is still patchy. An EasyDMARC study of 1.8 million domains published in April 2026 found that about 48% had no valid DMARC record at all, and only about 23% had a policy strict enough to actually block spoofed mail.

The hidden senders: your website and your apps

Most small businesses send email from more places than they realize:

• Your regular email, such as Google Workspace or Microsoft 365
• Your website, which sends contact-form notifications, order confirmations and password resets
• Your newsletter tool, such as Mailchimp or Constant Contact
• Your invoicing, booking, CRM or point-of-sale software

Each one has to be included in SPF, and ideally set up to sign with DKIM on your domain. Skip one and its mail fails, often quietly.

Websites are a common culprit. Out of the box, WordPress sends mail directly from the web server, which usually isn't on your SPF list and can't sign with your DKIM key. The fix is to route website mail through an authenticated email service using an SMTP plugin, which is one of the settings a good WordPress care plan checks.

A safe setup plan

1. List everything that sends email as your domain. Email provider, website, newsletter, invoicing, booking, CRM, point of sale. Ask whoever set each one up.
2. Publish one SPF record. A domain can have only one. Combine every approved sender into it. SPF also has a limit of 10 DNS lookups, so a long list of services can quietly break it.
3. Turn on DKIM for each service. Most providers give you a record or two to add to your domain, then a button to start signing.
4. Fix your website's mail. Send it through an authenticated service rather than straight from the web server.
5. Publish DMARC at p=none, with reporting turned on. Nothing gets blocked yet. You start receiving reports showing who is sending mail as you, and whether it passes.
6. Read the reports and fix the gaps. A free or low-cost DMARC report reader turns the raw reports into something readable. Expect to find at least one sender you forgot.
7. Tighten gradually. Move to quarantine, which sends failing mail to spam, and then to reject once everything legitimate passes.
8. Keep it current. Every time you add a new tool that sends email, add it to SPF and DKIM before you start using it.

These records live in your domain's DNS settings, wherever your domain is managed. If you don't know who controls your domain, that's worth finding out before anything else. Losing access to it is far worse than any spam folder.

A few more habits that help

• Send business mail from your own domain, not a free Gmail or Yahoo address. You can't authenticate a domain you don't own.
• Make unsubscribing easy on marketing mail, and honor requests quickly. It's required for bulk senders, and the law already requires a working opt-out, as we explain in who regulates your website?
• Only email people who asked to hear from you. Spam complaints count against you no matter how well your records are set up.

As a Cloudflare agency partner, Kosmic Edge manages DNS for many of the sites we host, and we set up SPF, DKIM and DMARC as part of our website development and hosting work, including routing website mail through an authenticated service.

Sources

• Google Workspace Admin Help, About authentication methods (updated October 2026)
• Yahoo Sender Hub, Sender best practices
• Red Sift, Gmail's enforcement ramps up: what bulk senders need to know
• Mailgun, Microsoft sender requirements
• Nacha, FBI's IC3 finds almost $8.5 billion lost to business email compromise in last three years (April 2025)
• EasyDMARC, 2026 DMARC Adoption & Enforcement Report (April 2026)

This article reflects mailbox provider requirements as of October 2026. Providers update their rules regularly, so check their sender guidelines before major changes.