Business Email Deliverability: SPF, DKIM and DMARC Explained Simply

On this page

1. Why emails go to spam
2. SPF: who may send
3. DKIM: a digital signature
4. DMARC: the policy
5. Website emails
6. Setup checklist
7. Be careful when changing DNS

If customers say your emails went to spam, or your website's order and enquiry emails never arrive, the problem is often missing email authentication. Three DNS records, SPF, DKIM and DMARC, tell receiving mail servers that your emails are genuine.

Why emails go to spam

• The sending server isn't authorised to send for your domain
• Emails aren't signed, so they can't be verified
• Your domain has no policy telling receivers what to do with unverified mail
• Website emails are sent from the web server without proper authentication

Still choosing a provider? See business email options for small businesses.

SPF: who may send

SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for your domain, for example your email provider and any service your website uses. Keep a single SPF record that includes all legitimate senders.

DKIM: a digital signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails. Your email provider gives you a DKIM record to add to DNS, and receiving servers use it to verify the message wasn't altered and really came from your domain.

DMARC: the policy

DMARC tells receivers what to do if an email fails SPF or DKIM checks (monitor, quarantine or reject) and can send you reports. Start with a monitoring policy, review the reports, then tighten it once all legitimate senders pass.

Website emails

WordPress forms and WooCommerce order emails often fail because they're sent using the server's basic mail function. Send them through an authenticated service (SMTP or a transactional email provider) that's included in your SPF and DKIM setup. This site sends form emails through an authenticated Gmail connection for the same reason.

Setup checklist

1. List every service that sends email as your domain (mailbox provider, website, newsletter tool, CRM)
2. Create or update one SPF record including them
3. Enable DKIM for each sending service
4. Add a DMARC record in monitoring mode
5. Test by sending emails to different providers and checking headers
6. Tighten DMARC once everything passes

Getting bounces for emails you never sent? See website sending spam emails.

Be careful when changing DNS

Mistakes in DNS can stop email entirely. When moving hosting or domains, copy all email records first; see domain, hosting and SSL explained and WordPress migration.

If enquiries aren't arriving, also read why contact forms stop getting enquiries.