Email Deliverability: SPF, DKIM and DMARC Explained

By Grocito16 October 2026

Email deliverability is the chance that your message reaches the inbox rather than spam or nowhere at all. Mailbox providers judge it using authentication (SPF, DKIM and DMARC), your sending reputation, the content of your messages and how recipients react. To improve it, list every system that sends mail for your domain, authenticate each one, start DMARC in monitoring mode and tighten the policy gradually.

Key takeaways

Authentication proves a message really comes from your domain. SPF says who may send, DKIM signs the message and DMARC says what to do when checks fail.
Authentication alone does not earn inbox placement. Reputation, content and recipient behaviour also count.
List every sender before changing records: website forms, newsletter tool, CRM, helpdesk, invoicing and your normal mailboxes.
Roll DMARC out in stages, from monitoring to quarantine to reject, and read the reports along the way.
Keep transactional and marketing mail on separate streams, ideally separate subdomains, so a marketing problem never blocks receipts and password resets.

Why does business email land in spam?

Mailbox providers receive an enormous amount of unwanted mail, so they are cautious by default. A perfectly honest message can still be filtered when something looks wrong. The usual causes are:

Missing or broken authentication. The receiving server cannot confirm that your domain approved the sender.
Weak sender reputation. A new domain, a sudden jump in volume, or past complaints make providers wary.
Poor list quality. Old, purchased or scraped addresses bring bounces, spam traps and complaints.
Content that looks risky. Misleading subject lines, link shorteners, image-only emails or mismatched link text.
Low engagement. If recipients rarely open, reply or click, and often delete unread, providers learn to treat you as low value.

Mailbox providers publish guidance for senders and update it over time. As far as is publicly documented, authentication, low spam complaints and easy unsubscribing are consistently expected, especially from senders who mail in volume. Read the current sender guidelines from the providers your customers use, because the details change.

SPF, DKIM and DMARC in plain English

These three standards work together. Each answers a different question.

SPF: who is allowed to send for my domain?

SPF (Sender Policy Framework) is a list published in your domain's DNS naming the servers and services allowed to send mail on your behalf. When a message arrives, the receiving server checks whether the sending server is on that list. Think of it as a guest list at the door.

DKIM: has the message been tampered with?

DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message. The sending system signs with a private key, and you publish the matching public key in DNS. The receiver checks the signature, which shows the message was authorised by the signing domain and was not altered in transit. Think of it as a wax seal.

DMARC: what should happen if the checks fail?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receivers which checks must pass and what to do if they do not. It also asks receivers to send you reports about mail claiming to come from your domain.

The three policy levels, in words:

Monitor only (none). Receivers take no special action but send you reports. This is the starting point.
Quarantine. Failing mail is treated as suspicious, usually sent to spam.
Reject. Failing mail is refused outright.

What is alignment?

DMARC does not just ask whether SPF or DKIM passed. It asks whether the domain they verified matches the domain in the visible From address. This match is called alignment. A newsletter tool might pass SPF for its own domain while your From address shows yours, and DMARC would still fail unless the tool signs with your domain using DKIM. This is the most common reason a "correctly set up" sender fails DMARC.

What about BIMI?

BIMI (Brand Indicators for Message Identification) lets some mailbox providers show your logo beside authenticated messages. It generally requires strong DMARC enforcement first, and further requirements vary by provider, so treat it as an optional finishing touch rather than a starting point.

How do I set up SPF, DKIM and DMARC safely?

The risk is not the technology but the order of operations. If you publish a strict policy before authorising every legitimate sender, your own invoices and enquiries start failing.

Inventory every sender. Include your mailboxes, website contact forms, newsletter platform, CRM, helpdesk, invoicing or payment tools, booking system, and any application that sends notifications. Ask each team, because marketing often adds tools the technical team never hears about.
Publish one SPF record. Add every authorised service to a single record. Your email provider and each tool's documentation give the exact entries to include.
Enable DKIM in each service. Each platform generates its own key. Publish it in your DNS and turn on signing, ideally with your own domain rather than the vendor's.
Publish DMARC in monitor-only mode. Point reports to a mailbox or monitoring service you will actually read.
Review reports for a few weeks. Look for legitimate senders that fail, and unknown senders that you do not recognise.
Fix and re-check. Add missing senders, fix alignment and repeat until legitimate mail passes consistently.
Tighten gradually. Move to quarantine, watch for problems, then move to reject when you are confident.

Our DevOps and infrastructure team can help if DNS changes feel risky, and our guide to choosing and protecting your domain covers who should control your DNS in the first place.

Common mistakes to avoid

Two SPF records. A domain should publish a single SPF record. Having two usually causes SPF to fail. Merge them into one.
Forgotten third-party senders. The old feedback-form tool, the helpdesk, the invoicing system. These are the senders that break once policy tightens.
Too many lookups. SPF limits how many DNS lookups a record may trigger, and every included service uses some. Pile on too many and SPF fails even though each entry looks fine. Remove services you no longer use, and ask your provider about options if you hit the limit.
Treating monitor-only as finished. It gives visibility but no protection from spoofing.
Skipping reports. Reports are how you discover problems before customers do.

Transactional and marketing streams

Password resets, order confirmations and invoices are expected and time-sensitive. Newsletters and promotions are more likely to draw complaints. Mixing them means a bad campaign can drag down receipts.

A common approach is to send each type from its own subdomain, for example one for transactional mail and another for marketing, each with its own authentication and reputation. Keep the visible brand consistent so customers recognise you. Our email marketing guide explains how to build the list and automations that sit on the marketing side.

List hygiene and sender reputation

Reputation builds slowly and falls quickly. Protect it with ordinary good practice:

Collect addresses with clear consent, and confirm sign-ups where appropriate.
Make unsubscribing obvious and honour requests promptly.
Remove hard bounces immediately and pause addresses that repeatedly fail.
Stop mailing people who have not engaged for a long time, or ask them to confirm they want to stay.
Warm up new domains and tools by starting with your most engaged contacts.
Never buy lists.

Data protection and email marketing laws differ by country and change over time, so check the rules for the places you mail with a qualified professional.

Testing and troubleshooting checklist

Send a test to several mailbox providers and open the message headers to see whether SPF, DKIM and DMARC are reported as passing.
Confirm the DKIM signing domain and the From domain align.
Check that exactly one SPF record exists.
Look at DMARC reports for unknown sources.
Check whether your sending domain or address appears on public blocklists.
Review bounce messages, since they often state the reason in plain words.
Re-test after any change to your DNS, mail tools or website forms.

A worked example

Imagine a small training company whose course enquiries and invoices sometimes vanish. It uses office mailboxes, a website contact form, a newsletter tool and an invoicing system, but only the mailboxes are in its SPF record, and the newsletter tool sends with its own domain. The owner lists all four senders, merges them into one SPF record, enables DKIM with the company domain in the newsletter and invoicing tools, and moves the contact form to authenticated sending. DMARC starts in monitor-only mode. Reports show one forgotten feedback tool still sending, which is added. After a few clean weeks, the policy moves to quarantine and later to reject, while newsletters move to their own subdomain.

FAQ

Do I need SPF, DKIM and DMARC if I only send a few emails?

Yes, it is still worth doing. Mailbox providers increasingly expect authentication, and without it your messages are easier to spoof and more likely to be filtered. Setting up all three is a one-off task that takes little time compared with the cost of missed enquiries.

What is the difference between SPF and DKIM?

SPF checks whether the sending server is on your approved list. DKIM checks a digital signature attached to the message itself, which shows it was authorised and not changed on the way. They protect against different problems, which is why DMARC looks at both.

Will DMARC stop my emails going to spam?

Not by itself. DMARC protects your domain from being spoofed and helps receivers trust authenticated mail, but inbox placement also depends on reputation, content, list quality and engagement. Treat it as the foundation rather than the whole solution.

How long does it take to move DMARC from monitoring to reject?

It depends on how many systems send mail for you. A simple setup may be ready within a few weeks, while a larger organisation with many tools may need longer to find and fix every sender. Move forward only when reports show legitimate mail passing consistently.

Next steps

Start today by listing every tool that sends email from your domain, then check whether each one is authenticated. If you would like help auditing your records and planning a safe rollout, contact us and we will walk through it with you.