SPF, DKIM, DMARC in Plain English

If your invoices, quotes, or marketing emails are landing in spam, the problem is almost never your subject line. It's three DNS records you've never heard of. I set these up for a 14-person services firm last month and their reply rate doubled inside a week. Same emails, same list. The mailboxes just started trusting them.

The three records, decomposed

Email authentication is one scary-sounding problem made of three smaller, boring problems. Name them and they stop being scary.

SPF is a list of servers allowed to send mail as your domain. It's a single line in DNS that says "Google can send for us, and so can our newsletter tool, and that's it." If something else tries, receivers can reject it.

DKIM is a signature. Your sending service signs each outgoing message with a private key. Receivers check the matching public key in your DNS. If the signature is valid, the message wasn't tampered with and it really came from an authorized sender.

DMARC is the policy that ties the first two together. It tells receivers what to do when SPF or DKIM fails ("ignore it," "send it to spam," or "reject it outright") and where to email the reports. Without DMARC, the other two records are advisory. With it, they have teeth.

The order to fix this

Don't try to do all three in one afternoon. You'll break something and not know which record did it. Ship the thin version this week, tighten next week.

• Day 1: Inventory every service that sends mail as your domain. Google Workspace or M365, your CRM, your invoicing tool, your newsletter platform, your booking system. Write them down. This is the step everyone skips and it's the one that matters.
• Day 2: Publish an SPF record that includes all of them. One record per domain. Test with a free checker before and after.
• Day 3: Turn on DKIM in each sending service and add the keys they give you to DNS.
• Day 7: Add a DMARC record at p=none with a reporting address. This does nothing punitive yet, it just collects data on who's sending as you.
• Week 3-4: Read the reports. Once nothing legitimate is failing, move to p=quarantine. A month after that, p=reject.

The whole project is maybe four hours of actual work spread over a month. The reason it takes a month is the waiting, not the doing. You want real reporting data before you tell the world to reject anything claiming to be you.

Why bother if email "works"

Because Gmail and Yahoo already require this from bulk senders, and the threshold for "bulk" keeps dropping. Because every quote that lands in a prospect's spam folder is a deal you won't close and won't know you lost. And because the day someone spoofs your domain to phish your customers, you'll wish you'd spent the afternoon.

If your email is mysteriously underperforming or you don't know what's in your DNS right now, this is exactly the kind of one-afternoon cleanup we do for small offices. Send us a note and we'll take a look.

— Alexander @ SBATC