Do I need SPF, DKIM and DMARC if I only send a few emails a day?

Yes. The strict bulk-sender rules mainly target domains sending thousands of messages a day, but every major provider uses authentication when deciding between the inbox and the spam folder. Google also states that all senders writing to personal Gmail accounts need at least SPF or DKIM. The records are free, take minutes to add, and also stop criminals from easily sending fake emails in your business name.

Can I have two SPF records?

No. A domain must have only one SPF record. When receivers find two TXT records starting with v=spf1, the check returns a permanent error and SPF is treated as failed. If you add a new email service, edit your existing SPF record and add the new include to it, keeping the total number of DNS lookups at 10 or fewer.

What is the difference between ~all and -all in SPF?

Both tell receivers what to do with mail from servers not listed in your record. The ~all ending is a soft fail, meaning treat it as suspicious, while -all is a hard fail, meaning it should be rejected. Both are far better than +all, which allows anyone to send as you.

How long does it take for new DNS records to work?

Most DNS changes are visible within minutes to a few hours, but they can take up to 48 hours depending on the time-to-live setting of the old record and the provider.

Will DMARC p=reject stop my own emails?

It can if you skip the monitoring stage. If a legitimate service, such as your invoicing tool or website form, sends as your domain without passing SPF or DKIM alignment, p=reject tells receivers to refuse those messages. That is why you start with p=none, read the reports, fix every legitimate sender, then move to quarantine and only later to reject.

What are DMARC rua reports?

The rua tag in your DMARC record gives an email address where mailbox providers send aggregate reports, usually once a day. They list which servers sent mail using your domain and whether those messages passed SPF, DKIM and DMARC. Most people use a report viewer to read the XML files.

Does setting up these records guarantee I will reach the inbox?

No. Authentication proves who you are, but providers also look at your reputation, spam complaints, content, sending volume and whether people engage with your messages. Correct SPF, DKIM and DMARC remove the most common technical reason for spam filtering, and they are now a minimum requirement for bulk senders, but good lists and wanted emails still matter.

Speed & Security

SPF, DKIM and DMARC Explained: Why Your Business Emails Land in Spam and How to Fix It

By ITCM Team · Updated November 2026

SPF, DKIM and DMARC are three DNS records that prove an email really comes from your business. SPF lists the servers allowed to send for your domain, DKIM adds a tamper-proof signature to each message, and DMARC tells Gmail, Outlook and Yahoo what to do when a message fails those checks, and sends you reports. Without them, your quotes, invoices and booking confirmations are far more likely to land in spam or be rejected, and anyone can pretend to be you. This guide explains each record in plain language, shows example records and walks you through checking and fixing your own domain.

Key takeaways

SPF, DKIM and DMARC are free DNS records that prove your emails are genuine.
You can only have one SPF record per domain, and it must stay under 10 DNS lookups.
Start DMARC at p=none with reports, then move to quarantine and finally reject.
Gmail, Yahoo and Microsoft Outlook now reject or filter mail from bulk senders that fail authentication.
Even small senders benefit: authenticated mail is trusted more and is harder to spoof.
Check your domain in a minute with a free email DNS checker before changing anything.

Why do my business emails go to spam?

Email has no built-in way to prove who sent a message; anyone can type your address into the From line. Mailbox providers fight this by checking whether the sending server is authorised by the domain owner and whether the message was altered on the way. If your domain has no answers to those questions, your mail looks exactly like a scam that borrows your name.

The most common reasons a small business ends up in spam are simple: no SPF record, a broken SPF record, DKIM never switched on with the email provider, or no DMARC record at all. Website contact forms and booking systems that send mail on your behalf are another frequent cause, because nobody added them to the records. Our guide to DNS for business owners explains the basics.

What do SPF, DKIM and DMARC actually do?

Think of them as three layers. SPF is the guest list, DKIM is the wax seal on the envelope, and DMARC is the rule book plus a reporting service.

Record	What it does	Where it lives	Plain-English analogy
SPF	Lists the servers and services allowed to send email for your domain	One TXT record on your root domain	The guest list at the door
DKIM	Adds a digital signature to every message so receivers can verify it was not changed	A TXT or CNAME record at selector._domainkey.yourdomain.com	A wax seal on the envelope
DMARC	Checks that SPF or DKIM matches the visible From domain, sets a policy for failures and requests reports	A TXT record at _dmarc.yourdomain.com	The rule book and the security camera

What does an SPF record look like?

An SPF record is a single line of text that starts with v=spf1 and ends with an all mechanism. A business using Google Workspace for mailboxes and a website that sends through Hostinger might publish something like: v=spf1 include:_spf.google.com include:_spf.mail.hostinger.com ~all. Each include points to the provider's own list of servers. The ~all at the end means mail from anywhere else should be treated as suspicious; -all means it should fail outright.

Two rules trip up more small businesses than anything else:

One SPF record only. If you add a second v=spf1 record for a new tool, SPF breaks with a permanent error and both records are ignored. Merge new services into the existing record instead.
Ten DNS lookups maximum. Every include, a, mx, redirect and exists counts toward a limit of 10. Go over it and SPF returns a permanent error, which receivers treat as a failure. Remove services you no longer use before adding new ones.
Do not forget hidden senders such as invoicing software, booking tools, newsletter platforms and the website itself.

What is DKIM and where do I get my key?

DKIM uses a pair of cryptographic keys. Your email provider keeps the private key and signs every outgoing message; you publish the public key in DNS so receivers can check the signature. You never write a DKIM key by hand. You switch DKIM on inside your email provider's admin panel, copy the record it gives you, and paste it into your DNS.

The record is published under a selector name. Google Workspace uses google._domainkey by default, Microsoft 365 uses selector1 and selector2 CNAME records, and Hostinger email uses the selectors hostingermail-a, hostingermail-b and hostingermail-c. Each sending service, such as a newsletter platform, needs its own DKIM record, and many providers need you to press an Enable button after publishing.

How does DMARC work, and which policy should I start with?

DMARC ties everything together. It passes only when SPF or DKIM passes and that result matches (aligns with) the domain in the From address your customer sees. It also lets you choose what happens to mail that fails, and asks receivers to send you daily summary reports through the rua tag.

A safe first record looks like this: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. Roll it out in stages:

p=none (monitor): nothing is blocked. Read the reports for two to four weeks to find every service sending as you.
p=quarantine: failing messages go to spam. Fix any legitimate sender the reports flagged before this step; you can use pct=25 to apply it to a share of mail first.
p=reject: failing messages are refused. This gives the strongest protection against people spoofing your domain.
Keep the rua address active; a DMARC report viewer makes the XML reports readable.

What do Gmail, Yahoo and Outlook require in 2026?

Since February 2024, Google and Yahoo require bulk senders, defined by Google as close to 5,000 or more messages a day to personal Gmail accounts, to pass SPF and DKIM, publish DMARC with at least p=none, align the From domain, offer one-click unsubscribe and keep reported spam below 0.3%. Google adds that all senders, not only bulk senders, need SPF or DKIM and must meet its baseline rules when writing to personal Gmail accounts.

In November 2025 Gmail began ramping up enforcement, and non-compliant messages can now receive temporary or permanent rejections. Microsoft followed for Outlook.com, Hotmail and Live addresses: from 5 May 2025, high-volume senders above 5,000 messages a day that fail SPF, DKIM or DMARC are rejected with the error 550 5.7.515.

Most plumbers, salons and clinics never reach 5,000 emails a day, but filters reward authenticated mail at every volume, so all three records are the safe default.

How do I check my SPF, DKIM and DMARC records?

You do not need technical tools or a command line. Our free email DNS checker looks up your domain and shows whether SPF, DKIM and DMARC exist and whether they look valid.

Enter your domain (yourcompany.com, not your email address) in the checker.
Confirm there is exactly one SPF record and that it includes every service that sends for you.
Check that DKIM is published for your main email provider and any marketing or booking tool.
Look for a DMARC record with a rua address so you receive reports.
Send a test email to a personal Gmail account, open it, choose Show original and confirm SPF, DKIM and DMARC all say PASS.

What are the most common SPF, DKIM and DMARC mistakes?

If you are setting up mailboxes from scratch, our business email setup guide covers the full order of steps, from choosing a provider to MX records.

Two SPF records after switching email providers or adding a new tool.
Leaving the old provider in SPF years after moving, which wastes lookups.
Publishing DKIM in DNS but never pressing the enable button in the email admin panel.
Copying a DMARC record with someone else's rua address, so reports go to a stranger.
Jumping straight to p=reject and blocking your own invoices or website form emails.
Typing the record at the wrong host name, for example dmarc instead of _dmarc.

How does ITCM handle email authentication?

When we recover a compromised site, as in our WordPress recovery case study, email records are part of the checklist, because attackers often abuse contact forms and weak domains to send spam that damages a business's reputation. The same applies to every site we build: forms send through an authenticated service, and SPF, DKIM and DMARC are checked before launch.

Our approach is demo-first. For the offer on our YouTube page, we build your website and installable app first, you review the finished result, and you pay $150 one-time only if you are happy. Email setup on its own is a separate piece of work, so if you need it we give a fixed quote before starting, through our business email setup service. For wider protection beyond email, see our website security guide.

Quick SPF, DKIM and DMARC checklist

List every service that sends email using your domain.
Publish one SPF record with all of them, under 10 lookups, ending in ~all or -all.
Enable DKIM in each service and publish its key.
Add DMARC at p=none with a rua reporting address.
Review reports for a few weeks, fix gaps, then move to quarantine and reject.
Recheck your records after any change of email provider, website host or DNS provider.

Frequently asked questions

Do I need SPF, DKIM and DMARC if I only send a few emails a day?: Yes. The strict bulk-sender rules mainly target domains sending thousands of messages a day, but every major provider uses authentication when deciding between the inbox and the spam folder. Google also states that all senders writing to personal Gmail accounts need at least SPF or DKIM. The records are free, take minutes to add, and also stop criminals from easily sending fake emails in your business name.
Can I have two SPF records?: No. A domain must have only one SPF record. When receivers find two TXT records starting with v=spf1, the check returns a permanent error and SPF is treated as failed. If you add a new email service, edit your existing SPF record and add the new include to it, keeping the total number of DNS lookups at 10 or fewer.
What is the difference between ~all and -all in SPF?: Both tell receivers what to do with mail from servers not listed in your record. The ~all ending is a soft fail, meaning treat it as suspicious, while -all is a hard fail, meaning it should be rejected. Both are far better than +all, which allows anyone to send as you.
How long does it take for new DNS records to work?: Most DNS changes are visible within minutes to a few hours, but they can take up to 48 hours depending on the time-to-live setting of the old record and the provider.
Will DMARC p=reject stop my own emails?: It can if you skip the monitoring stage. If a legitimate service, such as your invoicing tool or website form, sends as your domain without passing SPF or DKIM alignment, p=reject tells receivers to refuse those messages. That is why you start with p=none, read the reports, fix every legitimate sender, then move to quarantine and only later to reject.
What are DMARC rua reports?: The rua tag in your DMARC record gives an email address where mailbox providers send aggregate reports, usually once a day. They list which servers sent mail using your domain and whether those messages passed SPF, DKIM and DMARC. Most people use a report viewer to read the XML files.
Does setting up these records guarantee I will reach the inbox?: No. Authentication proves who you are, but providers also look at your reputation, spam complaints, content, sending volume and whether people engage with your messages. Correct SPF, DKIM and DMARC remove the most common technical reason for spam filtering, and they are now a minimum requirement for bulk senders, but good lists and wanted emails still matter.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles