You send a proposal from your domain and it lands in spam, or someone spoofs your company’s address. Both are solved with three DNS records.
SPF: who may send for you
yourdomain.com. TXT "v=spf1 include:_spf.google.com include:zoho.com ~all"- One SPF record per domain; combine providers with multiple
include:. - Max 10 DNS lookups, or SPF fails entirely.
- Start with
~all;-allis stricter.
DKIM: a signature on every message
Your provider signs messages with a private key; you publish the public key:
selector._domainkey.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."Every service that sends as your domain needs its own DKIM.
DMARC: what to do when checks fail
_dmarc.yourdomain.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"Start at p=none, review reports for a couple of weeks to catch legitimate senders you forgot (billing system, CRM, website form), then move to quarantine and eventually reject.
Alignment
DMARC requires the visible From: domain to match the domain validated by SPF or DKIM. A form that sends from a third-party domain “on behalf of” yours won’t align; configure each service to send with your domain and DKIM.
Gmail and Yahoo requirements
Since 2024, high-volume senders to Gmail and Yahoo must have SPF, DKIM and DMARC plus easy unsubscribe. Even at low volume, it noticeably improves delivery.
Verify
Send to Gmail → “Show original” → look for SPF: PASS, DKIM: PASS, DMARC: PASS.
Emails landing in spam? I’ll review your setup.