Email that arrives: SPF, DKIM and DMARC explained for business owners

A customer fills in your contact form, but your reply never arrives. Or your quote ends up in the spam folder. Often that is not down to the content of the email, but to the technology around it: your domain has not proved that you are the sender. Three DNS settings exist for this: SPF, DKIM and DMARC. In this article we explain what they do, what Gmail requires from senders and how to check them step by step.

The problem: senders are easy to forge

In email, any server can claim that a message comes from your domain. Receivers therefore need techniques to check whether a message really comes from you. That protects you (against misuse of your domain for phishing) and your customers, and it raises the chance that your own mail gets delivered.

SPF: who may send on behalf of my domain?

Sender Policy Framework (SPF), described in RFC 7208, lets you record in a DNS record which servers may send email for your domain. The receiving server compares the sender with that list. If you have several services that send mail (for example your mailbox, your newsletter tool and your invoicing software), they must all be in a single SPF record. Multiple SPF records for the same domain cause errors.

DKIM: has the message stayed unchanged in transit?

DomainKeys Identified Mail (DKIM), described in RFC 6376, adds a digital signature to every message. The sending service signs with a private key; the matching public key is in your DNS. The receiver can use it to check that the message was sent by an authorised service and was not altered on the way. Every service that sends mail for you usually has its own DKIM setting, which you enter with your DNS provider.

DMARC: what should happen if it goes wrong?

Domain-based Message Authentication, Reporting and Conformance (DMARC), described in RFC 7489, builds on SPF and DKIM. In DNS you state what receivers should do with messages that fail the check: nothing (“none”), quarantine or reject. You can also have reports sent to you, so you see who sends mail on behalf of your domain. An important part is alignment: the domain in the visible “From” address must match the domain approved by SPF or DKIM.

What does Gmail require from senders?

Gmail publishes requirements for senders. According to its official help page, since 1 February 2024 these requirements apply to all senders to Gmail accounts:

• Set up SPF or DKIM for the sending domain.
• Valid forward and reverse DNS records (PTR) for the sending servers.
• Use a TLS connection for sending.
• Keep the spam rate in Postmaster Tools below 0.3 percent.
• Format messages according to RFC 5322.
• Do not impersonate Gmail From addresses.

Anyone sending more than 5,000 messages per day to Gmail accounts must additionally set up SPF and DKIM and DMARC (the DMARC policy may be “none”), ensure alignment between the “From” domain and the SPF or DKIM domain, and for marketing and subscribed mail offer one-click unsubscribe and a visible unsubscribe link. If you are below that threshold, Google still recommends setting up all three, because it improves the chance that messages are delivered.

How to check what you have now

1. List all services that send mail with your domain: mailbox, website (contact form), newsletter tool, accounting, CRM, web shop.
2. Look up your current DNS records with your domain registrar or host. Check that there is exactly one SPF record and that every service appears in it.
3. Activate DKIM at each service that supports it and enter the requested records in DNS.
4. Set DMARC to “none” first, with a reporting address. That way you see what happens without mail being blocked.
5. Send a test message to a Gmail address and use “Show original” to check that SPF, DKIM and DMARC say “PASS”.
6. Tighten DMARC to quarantine or reject only once the reports show that all your legitimate senders pass.

Contact forms: a classic pitfall

Many websites send form mail through the web server, with your own address as the sender. That server is often not in your SPF record and has no DKIM signature. The result: your own form mail ends up in spam or is rejected. The better approach is to send via an authenticated mailbox or a transactional mail service for which you have set up SPF and DKIM, and to have the “From” address be an address on your own domain.

Other things that influence delivery

• Spam complaints. Gmail names a spam rate below 0.3 percent as a requirement. So only send to people who really opted in and make unsubscribing easy.
• Consistent sender. Do not keep switching address or domain.
• Clear content. No misleading subject lines and not only images.
• Clean lists. Remove addresses that keep bouncing.

What not to expect

SPF, DKIM and DMARC do not guarantee inbox placement. They are a precondition for receivers to recognise you as trustworthy. Whether a message lands in the inbox or in spam also depends on recipient behaviour and on the reputation of your domain and sending server.

In conclusion

Setting up email sounds small, but it directly affects your revenue: quotes, confirmations and invoices must arrive. At CUBO Agency we check the DNS settings for mail on every project and document hosting and maintenance properly. Want to automate repetitive mail flows too? See automation or book a free intro call.

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• Email sender guidelines (Gmail Help)
• RFC 7208: Sender Policy Framework (SPF) (IETF)
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (IETF)
• RFC 7489: DMARC (IETF)

Book an intro call