SPF, DKIM and DMARC for a Small Business Domain: Keep Your Email Out of Spam

The short answer

If email from your business domain keeps landing in spam, or a customer says your invoice "never arrived", the cause is usually missing or broken email authentication. Three DNS records fix most of it: SPF lists which services may send mail for your domain, DKIM signs each message so receivers can check it was not altered, and DMARC tells receivers what to do when a message fails and sends you reports about who is using your domain. Gmail now requires every sender to have SPF or DKIM, and anyone sending in bulk to personal Gmail accounts needs SPF, DKIM and DMARC together. This guide walks a small team through setting all three up without breaking mail that already works.

1. List everything that sends mail as your domain

Before touching DNS, write down every service that sends email with your domain in the From address. A typical small business has more than it thinks: the main mailbox provider, the website contact form, the online store, the invoicing or billing system, a newsletter tool, a booking app and maybe a helpdesk. Each one needs to be covered by SPF or DKIM, or its mail will start failing once you enforce DMARC. If you are not sure, send a test message from each and look at the headers in step 9.

2. Find out where your DNS is hosted

All three records live in DNS, so you need access to wherever the domain's DNS is managed. That is not always the registrar: if your nameservers point to your web host or a DNS service, you edit the records there. Check the domain's nameservers first, then log in to that service. Changing records at the wrong provider is the most common reason a fix "does nothing".

3. Publish one SPF record

SPF is a TXT record on the domain itself that starts with v=spf1. It lists your senders, usually as include: entries your providers give you, and ends with ~all (soft fail) or -all (fail). A domain must have exactly one SPF record: two separate SPF records is an error, so merge new senders into the existing record instead of adding another. SPF also allows at most 10 DNS lookups in total, and each include: counts, so remove services you no longer use rather than stacking more on.

4. Turn on DKIM for every sender

DKIM is set up inside each sending service. The service generates a key pair, keeps the private key, and gives you a public key to publish in DNS as a TXT or CNAME record under a name like selector._domainkey.yourdomain.com. Do this for the mailbox provider and for every tool from step 1 that supports it. Use a 2048-bit key where the service offers one; Gmail requires at least 1024 bits. DKIM matters more than SPF for forwarded mail, because a forward breaks SPF but leaves a valid DKIM signature intact.

5. Start DMARC in monitoring mode

DMARC is a TXT record at _dmarc.yourdomain.com. Start with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. The p=none policy changes nothing about delivery; it only asks receivers to send you daily aggregate reports. Use a dedicated mailbox or a DMARC report service for rua, because the reports are XML files that are hard to read by hand and can arrive in volume.

6. Fix alignment, not just pass or fail

DMARC only passes when SPF or DKIM passes and the domain it checked matches the domain in the visible From address. A newsletter tool can pass SPF for its own domain and still fail DMARC for yours. The fix is usually to set up a custom sending domain or DKIM for your domain inside that tool. Read the DMARC reports for a few weeks and fix each legitimate sender that fails alignment.

7. Send website and store mail through a real mailbox

Contact forms, WordPress and WooCommerce often send mail directly from the web server by default. That mail is not covered by your SPF or DKIM and is a classic cause of order confirmations going to spam. Configure the site to send through your mail provider with an authenticated SMTP connection or the provider's sending API, from an address on your domain. Then test a form submission and a store order end to end. Our WordPress and WooCommerce backups and uptime guide covers the other checks worth running on a store.

8. Sending straight from a VPS? Check reverse DNS

If a server you run sends mail itself, receivers also check reverse DNS. Gmail requires the sending IP address to have a PTR record pointing to a hostname, and that hostname must resolve back to the same IP address. Ask your provider how PTR records are set for your address, and check whether outbound mail is allowed on that network before you rely on it. For most small businesses, relaying through a mail provider is simpler and safer than running a mail server, and a dedicated IP only helps if its reputation is kept clean.

9. Test from the receiving side

Send a message from each sender to a personal Gmail account, open it, and use "Show original". Gmail shows SPF, DKIM and DMARC as PASS or FAIL for that message. Repeat for the mailbox, the contact form, the store and the newsletter tool. A DNS lookup tool can also confirm each record is published exactly once and has no typos. Changes can take time to appear because DNS answers are cached, so wait for the record's TTL before deciding a fix did not work.

10. Tighten the policy, then keep it current

Once the reports show your real senders passing, move DMARC to p=quarantine, watch for a few weeks, then move to p=reject if nothing legitimate fails. For domains that never send mail, publish v=spf1 -all and a DMARC record with p=reject so nobody can use them for phishing. Every time you add or drop a tool that sends email, update SPF, set up DKIM and check the next DMARC report. Add the domain renewal and DNS checks to your website monitoring so a lapsed domain does not take email down with it.

Quick checklist

Every service that sends as your domain written down
DNS edited at the provider your nameservers actually point to
Exactly one SPF record, under 10 lookups, no unused senders
DKIM on for the mailbox provider and every sending tool, 2048-bit where offered
DMARC published at p=none with a reports mailbox
Each legitimate sender aligned with your From domain
Website forms and store mail sent through authenticated SMTP or an API
PTR and forward DNS match for any server that sends mail itself
Test messages show SPF, DKIM and DMARC PASS in Gmail
Policy moved to quarantine, then reject; non-sending domains locked down

Moving a site off shared hosting at the same time? The shared hosting to VPS migration checklist covers keeping mail and DNS working during the move. Running your own server? Start with securing SSH on a Linux VPS.

Next steps

GlassHosting is a managed service and infrastructure provider: we run your servers on our own network, so you can run your business. If you would rather not chase DNS records, mail settings and updates yourself, read what managed hosting includes and managed vs unmanaged VPS, browse the plans, then tell us what you run or email sales@glasshosting.com.