Network and security
SPF, DKIM and DMARC explained: why does your email end up in spam?
Short answer
SPF, DKIM and DMARC are three settings in your domain's DNS that let a receiving server check whether an email really comes from you. SPF says which servers may send for your domain. DKIM puts a digital signature on each message. DMARC tells the receiver what to do when those two fail. If they are missing or wrong, more of your mail lands in spam and someone else can send in your name.
Why does this exist at all?
Because email was designed at a time when everyone trusted each other. The sender address of a message is a text field. Nothing in the basics of email checks whether info@yourcompany.nl really comes from your company.
Three checks were added on top later. All three are stored as a line of text in your domain’s DNS, the place that also says which server your website runs on.
What does SPF do?
SPF is a list. It states which mail servers may send on behalf of your domain. The receiving server looks at where the message came from and compares that with the list.
If you only send through Microsoft 365, the list is short. It gets more complicated once other systems also send in your name: the bookkeeping package that sends invoices, the online shop with order confirmations, the newsletter tool, the contact form on the website. Each of them has to be on the list, or their mail will not pass the check.
What does DKIM do?
DKIM puts a signature on every message. The sending server signs the mail with a secret key. The matching public key sits in your DNS, so the receiver can check that the signature is right and that nothing in the message changed on the way.
DKIM survives forwarding better than SPF. If someone forwards your mail to another address, the sending server no longer matches your SPF list, but the signature stays valid.
What does DMARC do?
DMARC is the agreement on top. It tells the receiver two things:
- The address the reader sees must match the domain approved by SPF or DKIM.
- What should happen to mail that does not meet that: nothing, send it to spam, or refuse it.
DMARC also asks receivers to send reports back. They show which servers send in your domain’s name and whether they pass. Those reports are how you find the systems you forgot.
| What it checks | What it does not do | |
|---|---|---|
| SPF | Whether the sending server is on your list | Does not work well for forwarded mail |
| DKIM | Whether the message is signed and stayed unchanged on the way | Says nothing about what the receiver should do |
| DMARC | Whether the visible address matches SPF or DKIM, and what happens if not | Only works if the other two are set up correctly |
Where does it usually go wrong?
A forgotten sender. The newsletter goes out through an external tool that was never added to SPF and does not sign with DKIM. As long as the policy is on none, you notice nothing. Once someone sets it to reject, the newsletters stop arriving.
Two SPF records. Every supplier writes in its manual that you should “add an SPF record”. After three suppliers there are three, and none of them counts.
DMARC has been on none for years. The record exists, so the check from Google and Microsoft is satisfied. But none protects against nothing: someone can still send in your name.
DKIM is not switched on. In Microsoft 365, DKIM for your own domain is a setting that someone has to enable. In many environments we take over, that never happened.
In what order do you set it up?
- Take stock. Which systems send mail with your domain as the sender? This is the most work and the part that needs knowledge of the business.
- Get SPF and DKIM right. One SPF record with all senders, DKIM on for every system that supports it.
- DMARC on none, with reports. Watch for a few weeks to see who else sends.
- Tighten. First to quarantine, then to reject, once the reports are clean.
Skipping step 4 is the most common choice and the reason spoofing still works. Skipping step 1 is the reason invoices suddenly stop arriving.
With business email and DNS management we do this as part of the setup. It is also one of the first things we check in Microsoft 365 security.