You send an offer and the client never receives it. It sits in spam or does not arrive at all. This is rarely the fault of the message content — usually the domain cannot prove that its owner really sent it.
Three records, three different jobs
| Mechanism | What it checks | What breaks without it |
|---|---|---|
| SPF | Whether the sending server is on the domain’s allowed list | Anyone can impersonate your address |
| DKIM | Whether the message carries a valid domain signature | No proof the content was not altered in transit |
| DMARC | What to do when SPF and DKIM fail, and where to send reports | Nobody knows who is impersonating the domain |
The mistakes I see most often
- Two SPF records on one domain. The standard allows one — two mean an error and a failed check.
- A missing entry for a sending system. The newsletter, booking system or website form sends from another server nobody added.
- DKIM enabled in the panel but no DNS record. The signature exists but cannot be verified.
- DMARC set straight to reject. The effect: your own messages stop arriving before anyone notices.
- Sending from a free address under company branding. A sender domain different from the sending server is a classic spam signal.
How to roll it out — order matters
1. List everything that sends email
Mail server, CRM, shop, contact form, invoicing software, newsletter tool. Each must be included, otherwise it will start disappearing into spam once protection is enabled.
2. Set one correct SPF record
A single TXT entry covering all sending sources. Watch the limit of ten DNS lookups — with several services it is easy to exceed, and the check then returns an error.
3. Enable DKIM in the provider panel and add the key to DNS
Microsoft 365 and Google Workspace generate the key in the admin panel. The record must be added at the domain operator — without this step, signing does not work.
4. Introduce DMARC in stages
Start with a monitoring policy and a reporting address. Over a few weeks you will see who sends on behalf of the domain — including systems you had forgotten. Only then move to quarantine, and finally to reject.
What else affects deliverability
- Domain and IP reputation — a new domain suddenly sending hundreds of messages looks suspicious.
- Recipient list quality — sending to dead addresses damages reputation quickly.
- Sender alignment — the “from” address should belong to the domain that passes the checks.
- Content — all caps, dozens of links and a ZIP attachment are classic warning signs.
- An unsubscribe option for bulk sending — its absence counts as a violation.
A quick test today
Send a message to your private address at another provider and inspect the headers. Three confirmations should appear: SPF, DKIM and DMARC. If any shows an error or is missing, you know where to start.
Correct email configuration is one-off work that saves contracts and invoices from the spam folder. To have it checked and organised together with your accounts, see Microsoft 365, Google Workspace and KSeF.