If your quotes, invoices or replies keep ending up in your customers’ spam folders, the cause is very often three DNS records most businesses have never heard of: SPF, DKIM and DMARC. Together they prove to the receiving mail server that an email really came from you. Without them, your genuine email looks exactly like the forged email criminals send in your name.
You can see how your domain is set up right now with our free email checker. This guide explains what it’s telling you.
Why This Matters More Than It Used To
Email was designed in an era when anyone could claim to be anyone. SPF, DKIM and DMARC were added later to fix that, and for years they were optional. Not any more: since 2024 Gmail and Yahoo require every sender to have SPF or DKIM, and anyone sending in volume to have all three, aligned with the From address. Microsoft followed for Outlook.com in 2025. Mail that doesn’t meet the rules is increasingly sent to spam or rejected outright.
SPF: Who Is Allowed to Send
Sender Policy Framework is a TXT record listing the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether the server that delivered it is on the list.
A typical SPF record looks like this:
v=spf1 +a +mx include:spf.protection.outlook.com ~all
aandmxallow your website’s server and your mail servers.include:pulls in another provider’s list — here, Microsoft 365. Newsletter and CRM tools give you their own include to add.~allat the end says “anything not listed should be treated as suspicious”.-allis stricter: reject it.
The Mistakes We See Most
- Two SPF records. You add one for your newsletter tool next to the one you already had. With two, SPF fails for everything. There must be exactly one; merge them.
- Too many lookups. Every
include,a,mxandredirect— including the ones inside the records you include — costs a DNS lookup, and receivers stop at 10. Past that, SPF fails for all your mail. Microsoft 365 alone uses several, so a few extra services tips you over. Remove includes for tools you no longer use. - Ending in
+all, which allows every server on the internet to send as you. - Forgetting a sender. If your website’s contact form, your accounting software or your booking system sends email as your domain, it needs to be covered.
Our email checker counts the lookups for you, including nested includes, and flags each of these.
DKIM: A Signature on Every Email
DomainKeys Identified Mail adds a cryptographic signature to every message you send. The matching public key is published in DNS, so the receiving server can confirm the email really came from your domain and wasn’t altered on the way.
DKIM keys live at a selector: a name your provider chooses, published at selector._domainkey.yourdomain.com. Common ones:
- cPanel hosting (including EDZNET):
default - Microsoft 365:
selector1andselector2(set up as CNAME records, then switched on in the Defender portal) - Google Workspace:
googleby default (generated in the Admin console under Gmail → Authenticate email)
Not sure which yours is? Open an email you’ve sent, view the original message, and look for s= in the DKIM-Signature header. Enter that in the checker’s selector box. Use a 2048-bit key where your provider supports it; 1024-bit still works but is the minimum.
DMARC: What to Do When Checks Fail
DMARC ties SPF and DKIM to the address people actually see in the From line, and tells receivers what to do when a message fails. It’s a TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
p=none— monitor only. Nothing is blocked, but you start receiving reports.p=quarantine— failing mail goes to spam.p=reject— failing mail is refused. Full protection against spoofing.rua=— where daily aggregate reports are sent. They show every server sending email as your domain, which is how you spot a forgotten sender — or a criminal.
Roll It Out in Stages
- Publish
p=nonewith aruaaddress. - Read the reports for a few weeks. Make sure every genuine service you use passes SPF or DKIM.
- Move to
p=quarantine, thenp=rejectonce you’re confident.
Jumping straight to reject before your senders are set up is the fastest way to lose genuine mail, so take it in steps.
How to Set Them Up on EDZNET Hosting
If your domain’s DNS is with us, log in to cPanel and open Email → Email Deliverability. It checks SPF and DKIM for each domain and can install the suggested records with one click. If you also send through Microsoft 365, Google Workspace or a mailing service, their includes and DKIM records need adding too — and DMARC is added as a TXT record in the Zone Editor.
Prefer us to do it? Open a ticket with the services you send email from, and we’ll set up SPF, DKIM and DMARC for you.
Checking Your Work
- Run your domain through the email checker. Aim for no red Fix results.
- If a record you’ve just changed still shows the old value, give DNS time and check it in the DNS propagation checker.
- Send a test email to a Gmail address, open it, choose Show original, and confirm SPF, DKIM and DMARC all say PASS.
Frequently Asked Questions
Do I need all three?
Yes, if you want reliable delivery. SPF and DKIM each prove something different, and DMARC is what tells inboxes to act on them. Big providers now expect all three from businesses.
Will these stop all my emails going to spam?
They remove the most common technical reason. Content, sending patterns, complaints and your server’s reputation still matter — see how spam filtering works.
My emails fail SPF even though my record is right.
Check that your email app is sending through your own mail server with authentication switched on. Sending through your internet provider’s server is a classic cause — see fixing Outlook’s outgoing server.
Do I need these on a domain that doesn’t send email?
It’s a good idea, because criminals love spoofing unused domains. Publish v=spf1 -all and v=DMARC1; p=reject to say the domain never sends mail.
