If customers say your emails land in their spam folder, or someone has received a fake invoice "from" your company, the cause is usually the same: three missing or misconfigured DNS records.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a list, published on your domain, of the servers allowed to send email for you. When your mail arrives, the receiving server checks that list. If you use Microsoft 365, the list must include Microsoft's servers. If your website or CRM also sends mail, those need adding too.
DKIM: a tamper-proof signature
DKIM adds a digital signature to every email you send. The receiving server checks it against a public key on your domain. A valid signature shows the message really came from you and was not changed on the way.
DMARC: what to do when checks fail
DMARC tells receiving servers what to do with mail that fails SPF or DKIM: deliver it, send it to spam, or reject it. It also sends you reports, so you can see who is sending email using your name.
Without DMARC, anyone can send an email that appears to come from your domain.
What we recommend
- Publish SPF with every service that sends mail for you, and nothing else.
- Turn on DKIM in Microsoft 365 for every domain you use.
- Start DMARC in monitoring mode, review the reports, then move to "quarantine" and "reject".
Setting these up correctly takes a few hours and protects your brand every day. We include it in every Microsoft 365 setup. Book a free IT assessment and we will check your domain for you.