SPF, DKIM, and DMARC are not the sort of things most small business owners want to think about every day.
But if customers say your emails are landing in spam, automated messages start bouncing, or somebody tries to impersonate your domain, these three DNS records matter.
They help receiving email providers decide whether a message claiming to come from your business is genuine. They also help protect your domain name from being used in convincing phishing messages. Use this checklist to understand what each record does and what to review before changing your DNS.
The Plain-English Version
Think of your business domain as the name above your shop door.
- SPF lists the services allowed to send mail using that name.
- DKIM adds a signature so recipients can check the message has not been altered.
- DMARC tells recipients what to do when those checks fail and can send reports back to you.
They work together. Having one record is better than having none, but a reliable email setup normally needs all three considered carefully.
What Is SPF?
SPF stands for Sender Policy Framework.
It is a TXT record in your domain's DNS settings. It lists the servers or services authorised to send email for your domain.
For a small business, that list might include:
- Your hosted business mailbox.
- Microsoft 365 or Google Workspace.
- Your website contact form.
- An invoicing platform.
- A booking system.
- A newsletter service.
If you start using a new system to send email and forget to account for it, some recipients may distrust or reject those messages.
A common SPF mistake
Do not create several separate SPF records. A domain should normally have one SPF policy that includes the sending services you use.
If you do not know what belongs in that record, ask your email provider before changing it.
What Is DKIM?
DKIM stands for DomainKeys Identified Mail.
It adds a digital signature to outgoing email. The receiving server can compare that signature with a public key stored in your DNS records.
The practical result: a recipient gets more evidence that the message really came from an authorised service and was not altered on the way.
Your email provider normally gives you the DKIM record or records to add. The name often contains a selector and _domainkey.
A common DKIM mistake
Adding the DNS record is only part of the job. The sending service must also be configured to sign outgoing messages. Follow the provider's instructions and test afterwards.
What Is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
DMARC looks at the results of SPF and DKIM checks and tells receiving email servers how to treat messages that do not pass.
A DMARC policy can ask receivers to:
- Monitor failures without changing delivery.
- Quarantine suspicious messages, often by placing them in spam.
- Reject messages that fail the checks.
DMARC can also send reports showing which services are trying to send email using your domain.
Start carefully
Do not jump straight to the strictest policy without checking your legitimate sending services first.
If your website, invoice system, CRM, or newsletter platform is not configured correctly, a strict DMARC policy can cause your own messages to fail.
Start with monitoring, review the reports, fix legitimate senders, and then tighten the policy with help from someone who understands your setup.
How SPF, DKIM, and DMARC Work Together
| Record | The question it answers | Why your business cares |
|---|---|---|
| SPF | Is this sending server allowed to send for the domain? | Helps recipients recognise approved mail systems |
| DKIM | Does the message have a valid domain signature? | Helps prove the message is genuine and unchanged |
| DMARC | What should happen when authentication fails? | Protects your domain and gives you visibility through reports |
These records do not replace good passwords, two-factor authentication, or sensible staff training. They solve a different problem: proving that email sent in your domain's name comes from an expected source.
What to Check When Emails Go to Spam or Bounce
If everyday business messages stop arriving reliably:
- Save an example bounce message or note which recipient found the email in spam.
- List every service that sends email using your domain.
- Check whether your domain has one valid SPF record.
- Confirm DKIM signing is active for your mailbox provider.
- Check your DMARC record and current policy.
- Review whether a new booking platform, website form, CRM, or newsletter service was added recently.
- Send test messages to Gmail and Outlook addresses and record the results.
For symptom-led troubleshooting, read WooCommerce Order Confirmation Emails Going to Spam? or Business Emails Bouncing Back? How to Read the Error and Fix the Cause.
Why DNS Changes Need Care
SPF, DKIM, and DMARC live in your domain's DNS settings. That means the place you manage them may be your registrar, hosting provider, DNS provider, or another service.
Before editing anything, confirm which company controls the authoritative DNS for your domain. If you want your registration and DNS support kept together, explore Eazyhosting Domain Names.
A typo can cause authentication checks to fail. Removing records without understanding them can affect email delivery. Replacing nameservers can move control of more than email.
This is a small change, but it matters. Read What Is DNS? and How to Change DNS Settings before editing records yourself.
UK Small Business Questions
Do I need these records if I only send ordinary emails?
Yes. Authentication is not only for newsletters. Quotes, invoices, replies, password resets, and contact form notifications all benefit from a domain recipients can trust.
Do SPF, DKIM, and DMARC stop all spam?
No. They help recipients verify email claiming to come from your domain. They do not filter every unwanted message arriving in your inbox.
Do I need a domain name first?
Yes. These records belong to your domain. If you are still choosing one, start with Domain Registration UK: A Plain-English Guide for Small Businesses.
Can I set this up myself?
Often, yes. But ask for help if several systems send email for your business or you are unsure where DNS is controlled. It is better to map the route before changing it.
Treat Email as Part of the Business Setup
Email authentication should not be a collection of mysterious records nobody wants to touch.
Eazyhosting helps UK small businesses manage professional email alongside domains, DNS, and hosting, so the full route is visible when something needs fixing. Explore Business Email Hosting for a practical setup with support when you need it.
