If your emails land in spam, or scammers are spoofing your domain: the fix is three DNS records: , and .
These three records tell the world which servers are allowed to send email for your domain, and what to do with anything that fails the check. Together they protect your deliverability and your brand.
SPF, who can send for you
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email from your domain. Example: v=spf1 include:spf.protection.outlook.com -all. The -all means "reject anything not listed". Keep it to one SPF record with all your senders included.
DKIM: a tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message so the receiver can verify it really came from you and wasn't altered. Your mail provider gives you DKIM CNAME/TXT records to publish, for example, Microsoft 365 and Google Workspace both generate these in their admin console.
DMARC: the policy that ties it together
DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports. Start in monitor mode: v=DMARC1; p=none; rua=mailto:[email protected]. Once reports show your legitimate mail passes, tighten to p=quarantine then p=reject.
The order to set them up
- Publish SPF with every sending service included.
- Enable DKIM in each mail provider and publish their records.
- Add DMARC at
p=noneand read the reports for a couple of weeks. - Move DMARC to quarantine, then reject.
Common mistakes
- More than one SPF record (only one is allowed).
- Forgetting a service you send from (CRM, newsletter tool): it'll fail SPF.
- Jumping straight to
p=rejectand blocking your own legitimate mail.
Key takeaways
- SPF lists who may send; DKIM signs messages; DMARC sets the policy.
- Only one SPF record, include every sending service.
- Start DMARC at p=none, then tighten to quarantine and reject.
- These records keep you out of spam and stop domain spoofing.
Email that reaches the inbox
We set up Microsoft 365 and email authentication so your messages land where they should.
Explore Microsoft 365Frequently asked questions
Why are my emails going to spam?
Missing or misconfigured SPF/DKIM is the most common cause. Receivers distrust mail that can't be authenticated.
Do I need all three records?
Yes for best results. SPF and DKIM prove authenticity; DMARC enforces a policy and gives you visibility through reports.
Can Gander Web set these up for me?
Yes. We configure SPF, DKIM and DMARC as part of email and Microsoft 365 setup.