You send a quote to a client you really want, and nothing comes back. A week later they mention, almost in passing, that it was sitting in spam. Or the form on your site "doesn't work", except it does: the messages leave, they just never reach an inbox.
Both problems usually have the same cause. Your domain never told the world's mail servers who is allowed to send in its name.
The big providers stopped giving anyone the benefit of the doubt a while ago. Since 2024 Google and Yahoo require senders to authenticate their domain, and anyone sending in volume needs all three records below.
Three records, three questions
They're short lines of text in your domain's DNS settings, the same place your website's address is configured. The server receiving your message checks each one.
SPF: who is allowed to send?
SPF lists the servers that may send mail for your domain. That means your mailbox provider, but also the newsletter tool and the CRM that emails invoices. Mail from a server that isn't on the list looks forged. A domain can have only one SPF record. Publish two and the check fails for everything.
DKIM: was the message changed on the way?
DKIM signs every message. The public half of the key sits in DNS, and the receiving server uses it to confirm the message came from you and wasn't altered. Each service that sends as your domain has its own key, so you switch DKIM on in each of them separately.
DMARC: what happens when a message fails?
DMARC connects the two checks above to the address your client actually sees in "From". A message passes if SPF or DKIM passes for that same domain. DMARC also tells the receiving server what to do with failures (let them through, send them to spam, or reject them) and where to send you reports.
What we keep finding in Moldova
- The website form sends through the hosting company's shared server. The "From" line shows your company address, but there's no DKIM signature and the server isn't in your SPF. To DMARC that is exactly what a forgery looks like.
- SPF was set up once, years ago. Since then someone added a CRM, a newsletter service or an invoicing program, and nobody added them to the list.
- Two SPF records: one left over from the old host, one added for the new mail provider. Together they're invalid.
- DKIM is switched on for the mailbox and nothing else.
- No DMARC at all. Apart from the delivery problems, that means anyone can send email that looks like it came from you. A fake invoice to one of your clients, say.
It happened to us
At one point the contact form on one of our own sites was delivering straight to spam. It was the first item on that list: the host rewrote the sender, SPF didn't line up with the domain, and nothing signed the message. We moved the form to a real mailbox on the domain, logging in over SMTP, and checked again. SPF, DKIM and DMARC all pass now.
The annoying part is that nothing looked wrong. The form said "Message sent" every single time.
Checking takes ten minutes
- Send an email from your company address to a personal Gmail account.
- Open it in Gmail and, from the three-dot menu, choose the option that shows the original message.
- Find the SPF, DKIM and DMARC lines. You want PASS on all three.
- Do the same for everything else that sends mail as you: the site form, the CRM, the invoicing program, the newsletter.
- Run your domain through a free checker such as MXToolbox. It will flag a duplicate SPF or a missing DMARC.
One FAIL, or one missing line, and you've found your problem.
Fixing it, in order
- List every system that sends email as your domain. Skip this and the next SPF change will quietly break one of them.
- Write one SPF record that covers all of them.
- Turn on DKIM in each service and publish its key in DNS.
- Publish DMARC with
p=noneand a reporting address. Nothing gets blocked yet, but you start getting daily reports on who is sending as you. - When two to four weeks of reports look clean, move to
p=quarantine, then top=reject. From then on, forged mail in your name doesn't reach your clients.
DNS changes happen in the account where the domain is registered, and one typo can stop all of the company's email. If you're not sure who has access or what sends mail as you, do step 1 first and leave DNS alone until it's done.
The short version
SPF says who may send. DKIM proves the message is yours. DMARC ties both to the address your client sees and decides what happens to fakes. Setting them up is usually a few hours of work, which is a good trade for months of quotes nobody saw.
Email setup on your domain is part of our maintenance and support. If you'd like us to look at yours, write to us.