Emails in spam? DKIM & co. explained

A quote, an invoice, an important reply – and the customer says they never received anything. Often it isn’t a typo, but a missing sender check. The big email providers now require your domain to prove who may send email on its behalf.

Three records, three jobs

• SPF defines which servers may send email for your domain – your mail server and your newsletter service, for example.
• DKIM is a digital signature: the server signs every email, and the recipient checks it with a key from your domain. That makes it clear the email comes from you and wasn’t changed along the way.
• DMARC tells recipients what to do with emails that fail SPF or DKIM – deliver, move to spam or reject – and sends you reports about it.

All three are records in your domain’s DNS. Recipients never see them; spam filters rely on them.

Why it’s now a must

There’s no law behind it, but the rules of the big providers:

• Since February 2024, Google and Yahoo have required at least SPF or DKIM from all senders. Anyone sending more than 5,000 emails a day to Gmail needs SPF, DKIM and DMARC.
• Since May 2025, Microsoft has required the same from senders who send a lot of email to Outlook.com, Hotmail and Live.
• Emails that don’t meet the rules end up in spam – and increasingly they are rejected altogether.

Even if your business stays far below these volumes: many spam filters count missing records against you. And without DMARC it’s easier to send emails that look as if they came from your domain – something fraudsters posing as your company take advantage of.

How to check your domain

Send yourself an email to a Gmail address, open it and choose “Show original”. It shows PASS or FAIL for SPF, DKIM and DMARC. Alternatively, free online checkers show your domain’s records.

Typical pitfalls

• The newsletter service or invoicing software sends on behalf of your domain but isn’t listed in the SPF record.
• DKIM would be available at the email provider but was never switched on.
• There are several SPF records – then none of them is valid.
• DMARC is set straight to “reject” before all senders are set up properly – and suddenly real emails disappear.

The safest route is step by step: first set up SPF and DKIM for every service, start DMARC with “none” and watch the reports, then tighten it to “quarantine” and finally to “reject”.

With our web hosting and email, we set up SPF, DKIM and DMARC for your domain – and check that your newsletter, shop and invoicing software are included properly.