A message from your company is sitting in a customer’s spam folder. Nothing in it is spam. The receiving system simply could not confirm that it came from you. We deal with this regularly, often between two offices of the same company.
The three records
- SPF lists the servers that are allowed to send mail for your domain.
- DKIM adds a signature to each message so the receiver can check it was not altered on the way.
- DMARC tells receivers what to do with mail that fails those checks, and sends you reports about who is sending in your name.
All three are published in your domain’s DNS. They cost nothing.
Why it matters more than it used to
Google’s email sender guidelines expect SPF or DKIM from everyone who sends to Gmail accounts. Senders of more than about five thousand messages a day must have all three, offer one-click unsubscribe on marketing mail and keep spam complaints low. Other large providers have followed with similar rules.
Where it goes wrong
- A new tool starts sending as your domain, such as a CRM, an invoicing system or a newsletter service, and nobody adds it to the records.
- There are two SPF records. Only one is allowed, and having two breaks both.
- DMARC was set to reject before anyone checked the reports, and real mail is now being refused.
- A partner’s mail filter is strict, and your domain needs to be added to its allow list.
What to do
List every system that sends email as your company. Publish SPF and DKIM for each. Start DMARC in monitoring mode, read the reports for a few weeks, then tighten the policy. Review the list whenever you add a tool that sends mail.
Related service: IT security & penetration testing.