23 October 2026
SPF, DKIM and DMARC: why your business email may land in spam
Three DNS records tell email providers that your messages are genuine. Without them, your quotes and invoices can end up in junk folders.
Many business owners find out their email is going to spam only when a client says they never received a quote. The usual cause is missing sender-authentication records on the domain.
Three DNS records do the job. Together they tell receiving mail servers which messages are really from your business.
SPF: who is allowed to send for your domain
An SPF record lists the mail servers that may send email using your domain name. If a message claims to be from you but comes from somewhere else, the receiving server can see that it isn't on the list.
DKIM: a signature on every message
DKIM adds a cryptographic signature to outgoing messages. The public key is published in DNS, so the receiving server can check that the message was not altered in transit and was sent by an authorised system.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM together. It tells receiving servers what to do with messages that fail both checks (leave them alone, quarantine them or reject them) and where to send reports. Start with a monitoring policy, review the reports and tighten the policy once legitimate senders are all passing.
What to do
- Check whether your domain already has SPF, DKIM and DMARC records. Your email provider shows what it expects.
- Add or correct the records in cPanel under Zone Editor, or in your DNS host.
- Send a test message to a Gmail or Outlook address and check that it arrives in the inbox, not spam.
- Keep the records up to date whenever you add a new email or marketing tool that sends for your domain.
We set these records up as part of every business email installation, and we check them again when you add a new sender.
Want this checked for your business?
Tell us about your email, website or systems and we'll reply within one business day with next steps.