SPF, DKIM and DMARC explained: getting business email into the inbox

If your website’s enquiries, quotes or order confirmations keep landing in spam, the cause is very often missing or broken email authentication. Here is SPF, DKIM, DMARC explained for a UK small business in one breath: SPF is a DNS record listing the servers allowed to send mail for your domain, DKIM adds a signature that shows if a message has been tampered with, and DMARC tells Gmail, Outlook and the rest what to do with mail that fails both, and sends you reports. Set all three, send website email through a proper mail service instead of the web server, and in our experience most of these problems go away.

None of this needs new software or a large budget. It is a handful of DNS records, a change to how the website sends mail, and a few weeks of reading reports before you tighten the policy. It is fiddly work, though. One wrong character can stop your invoices arriving, so the order you do things in matters.

Why website emails go to spam

A mailbox provider has a fraction of a second to decide whether a message really comes from the business named in the From line. A typical small-business website gives it several reasons to doubt.

• The web server sends the mail itself. Out of the box, WordPress and most PHP sites hand email to the hosting server’s built-in mail function. That server is rarely listed in your SPF record and does not sign anything with DKIM.
• The sending IP address is shared. On shared hosting, many other sites, sometimes hundreds, send from the same address. If one of them has been pumping out junk, your order confirmations inherit its reputation.
• The form pretends to be the visitor. Many contact forms put the enquirer’s address in the From field so that you can press reply. To the receiving server that looks like your website forging a message from someone at Yahoo or Gmail, which is the exact behaviour DMARC was designed to stop.
• There is no DMARC record. Without one, receivers have no instruction from you and fall back on their own guesswork.

The third one is the easiest to fix. The From address should always be a real address at your own domain, such as website@yourdomain.co.uk, with the visitor’s address in the Reply-To header.

SPF, DKIM, DMARC explained in plain English

All three are text records in your domain’s DNS, the same place that says where your website lives. Our guide to choosing and owning a UK domain covers who should control that DNS. Here we go into what the records do.

SPF: the guest list

An SPF record is a single line. For a business with Microsoft 365 mailboxes it might read v=spf1 include:spf.protection.outlook.com ~all (Microsoft’s own example ends in -all), with one more include: for each other service that sends as you. Google Workspace uses include:_spf.google.com. Three rules catch people out:

• One SPF record per domain. If a second one is added, say by a newsletter tool’s set-up wizard, receivers treat the result as a permanent error, so SPF cannot pass for any of your mail. Merge them into one line.
• No more than ten DNS lookups. Every include:, a and mx entry counts, and so do the lookups nested inside each include. Four or five services can reach the limit. Remove the ones you stopped using years ago.
• End with ~all or -all. -all means anything not listed is not ours; ~all means it probably is not. Once DMARC is in place we normally use ~all and let DMARC do the enforcing. Never publish +all, which authorises the whole internet.

DKIM: the signature

With DKIM, the sending service holds a private key and uses it to sign each message. The matching public key sits in your DNS under a name called a selector, so the receiver can check the signature. Each service has its own selector, which means you can have as many DKIM records as you have senders. Choose 2048-bit keys where the provider offers them.

The step we most often find missing is this one: Microsoft 365 and Google Workspace do not sign with your own domain until you switch it on. In Microsoft 365 that means publishing two CNAME records and enabling DKIM for the domain in the security portal. In Google Workspace you generate a key in the Admin console, publish it as a TXT record and press “Start authentication”. Until then your mail is either unsigned or signed with the provider’s own domain, and neither counts for DMARC.

DMARC: the policy and the reports

A starting DMARC record looks like this: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk. The p tag is the policy and has three settings.

The idea that trips most people up is alignment. A message passes DMARC if SPF or DKIM passes and the domain that passed matches the domain in the From address. A newsletter platform can pass SPF perfectly well for its own bounce domain while your message still fails DMARC, because that domain is not yours. The cure is to set up the platform’s DKIM for your domain, which is the essential part, and its custom return-path record if it offers one. Every decent provider documents this under “domain authentication”.

Setting up the three records, step by step

1. List everything that sends email as your domain. The mailboxes, the website (forms, order emails, password resets), the newsletter tool, accounting software that emails invoices, the CRM, the booking system, the helpdesk and the office scanner. This is the step people skip, and it is why a strict policy later blocks their own invoices.
2. Find where your DNS is hosted. Look up the domain’s nameservers. Records added at the registrar do nothing if the nameservers point at Cloudflare or at your web host.
3. Publish one SPF record with an include for each legitimate service on the list.
4. Switch on DKIM in every service, adding the records each one gives you.
5. Publish DMARC at p=none with a reporting address.
6. Send test messages from every system and check the results, as described further down.
7. Read the reports for a few weeks before tightening anything.

Sending website email through a transactional provider

We advise against letting the web server send mail. A transactional email service is a company whose whole business is delivering one-to-one automated messages: Postmark, Mailgun, SendGrid, Amazon SES and Brevo are some of the better-known names. The website connects to it over SMTP or an API. The provider gives you DKIM records and a return-path record for your domain so that both checks align, and it keeps a log of every message with its outcome: delivered, bounced or marked as spam.

That log earns its keep the first time a customer says “I never got my confirmation”. You can see in seconds whether the message was accepted by their mail server, instead of guessing.

On WordPress the switch is made with an SMTP plugin or a few lines of code in the theme, and takes under an hour once the DNS records are in. For a shop, test every email the system sends: new order, processing, refund, password reset and the admin copy. Our WooCommerce guide covers the rest of a UK shop set-up.

Keep newsletters and transactional mail on separate streams, ideally with marketing sent from a subdomain such as news.yourdomain.co.uk. If a campaign draws spam complaints, the damage stays on the subdomain and your order confirmations keep arriving.

The Google and Yahoo sender requirements

In February 2024 Gmail and Yahoo began enforcing published rules for anyone sending to their users, and Microsoft announced similar requirements for Outlook.com, Hotmail and Live addresses in 2025. As we read the guidelines at the time of writing, they come to this:

Most small businesses send nowhere near 5,000 messages a day to Gmail addresses. Do the full set anyway. Google counts all mail from your domain together, including whatever the newsletter platform sends on your behalf, and its guidance says that a domain classed as a bulk sender keeps that status.

Authentication also stops people impersonating you

Invoice fraud usually starts with an email that appears to come from a supplier’s real address. With DMARC at p=reject, a criminal can no longer send mail as your exact domain to anyone whose provider checks DMARC, which covers the large mailbox providers. That is why the National Cyber Security Centre recommends SPF, DKIM and DMARC as part of its email security guidance. DMARC does not stop lookalike domains (yourdomain-accounts.co.uk) or a hacked mailbox, so it is one control among several, not a cure.

How to check and monitor

• Send yourself a test. From each system on your list, send a message to a Gmail address, open it, choose “Show original” from the three-dot menu and look for SPF, DKIM and DMARC each marked PASS with your own domain beside it.
• Run a free checker. The NCSC’s “Check your email security” tool, MXToolbox and the inspectors on dmarcian read your public records and flag syntax errors, duplicate SPF records and lookup counts.
• Set up Google Postmaster Tools. It is free and shows your spam complaint rate and authentication results for mail sent to Gmail, though only once you send enough for Google to report on.
• Use a DMARC report reader. Aggregate reports arrive daily as XML files that nobody wants to read by hand. Several services turn them into a weekly summary, and some have free tiers for a single domain.
• Test the forms monthly. Send a real enquiry through the website and check where it lands. It belongs on any WordPress maintenance plan.

In the reports you are looking for two things. Sources you recognise that are failing need fixing: usually a forgotten service or DKIM that was never enabled. Sources you do not recognise are either someone spoofing you, which the policy will deal with, or a system a colleague signed up to without telling anyone.

A rollout plan from p=none to p=reject

Cover a month end in stage one because that is when the systems you forgot about wake up: the payroll provider, the statement run from the accounts package, the direct debit notices. The pct tag asks receivers to apply the policy to a percentage of failing mail. The current DMARC standard (RFC 9989, May 2026) has dropped it in favour of a simple testing flag, t=y, because receivers applied percentages inconsistently. Google still documents pct, but do not rely on it elsewhere. Before moving to reject, make sure every sender signs with DKIM for your domain, not SPF alone, and remember that mail your staff post to mailing lists may be refused. If that matters to you, stay at quarantine.

Two opposite mistakes are common. One is jumping straight to p=reject on day one and discovering a week later that quotes have been bouncing. The other is leaving p=none in place for years. A monitoring-only policy satisfies the bulk-sender minimum but gives no protection against spoofing at all.

What tends to break on the way

• Forwarding. When a recipient forwards mail automatically to another address, SPF fails because the forwarding server is not on your list. DKIM usually survives, which is the main reason to have both.
• “Send as” in third-party tools. A CRM or quoting tool that sends from your address needs its own DKIM set-up.
• Scanners, printers and old line-of-business software that email directly. Route them through your mailbox provider’s relay.
• Subdomains. They inherit the main policy unless you set a separate one with the sp tag or give the subdomain its own DMARC record.
• Domains that never send mail. Spare and parked domains should publish v=spf1 -all and a DMARC record at p=reject, plus a null MX record, as the NCSC recommends, so nobody else can use them.

Common mistakes we find

• An SPF record that needs more than ten lookups, half of them for services cancelled long ago.
• DKIM never enabled on Microsoft 365 or Google Workspace.
• DMARC reports going to a mailbox that does not exist, or that nobody opens.
• Records added at the registrar while the nameservers point somewhere else.
• Email left behind on an old hosting account after the website moved. Our guide to website hosting for UK small businesses explains why we keep email and web hosting apart.

What it costs: a worked example

The DNS records are free. The cost is the time to audit, configure, test and watch the reports. Take an illustrative Manchester gift shop running WooCommerce, with Microsoft 365 mailboxes, a newsletter platform and accounting software that emails invoices. We charge WordPress development at £50 an hour through hourly hire.

6 hours × £50 = £300. Volume discounts start at 10 hours, so none applies here. Add VAT at 20 % (£60) and the total is £360. The transactional provider is billed separately by the provider, and at this shop’s volume would be free or a few pounds a month. A sole trader with one mailbox and a five-page site can do the whole job in an afternoon with the checklist below.

Email authentication checklist

• Every system that sends as your domain is written down
• You know where the DNS is hosted and have the login
• One SPF record, under ten lookups, ending ~all or -all
• DKIM switched on for the mailbox provider and each third-party sender
• DMARC record published with a working report address
• Website mail goes through a transactional provider, not the web server
• Forms send From your own domain with the visitor in Reply-To
• Test messages show SPF, DKIM and DMARC as PASS in Gmail
• Newsletters sent from a separate stream or subdomain
• Policy moved to quarantine, then reject, on a planned date
• Parked domains locked with -all and p=reject
• Reports reviewed monthly, forms tested monthly

We are based in London and sort out email deliverability for businesses across the UK, usually alongside website work or as part of our cybersecurity and IT consulting services. If your enquiries are going missing, tell us your domain and we will look at the public records and say what is wrong before you spend anything.

Photo: Mathyas Kurmann via Unsplash