Email Deliverability: SPF, DKIM and DMARC Setup

The companies that run your customers' inboxes decide whether to trust a message by checking that it really came from your domain. Three records do that work:

• SPF (Sender Policy Framework) lists the servers allowed to send mail as your domain.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so receivers know it came from you and was not changed on the way.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that fails those checks, and reports back on who is sending as you.

When these records are missing or wrong, genuine mail is treated with suspicion and forged mail is not stopped. Large mailbox providers now expect them from anyone sending regularly.

Most businesses find out the hard way: a quote never arrives, a newsletter lands in spam, or a customer receives a fake invoice. You also need it when you start an email campaign, change email provider, or add a tool that sends mail for you, such as a CRM, an invoicing system, a booking tool or a website form.

We read what your domain publishes today, then list every service that sends as you. This is the step that finds the surprises: an old marketing tool, a forgotten server, a vendor sending invoices on your behalf.

Then we set up SPF and DKIM for each genuine sender and bring in DMARC in stages. We start in monitoring mode, read the reports, fix the senders that fail, and only then move to quarantine (suspect mail goes to spam) and finally reject (suspect mail is refused). For campaigns we plan a warm-up, raising the volume gradually so providers learn to trust the domain.

You finish with a one-page record of the final settings and who owns each sender.

• Secure by default: the end state is a domain that forged mail cannot use, with two-step sign-in on your mail accounts.
• Built to scale: the setup has room for the next tool, so adding a sender means one change, not a new investigation.
• Tested before it ships: every sender is tested against the checks before the policy is tightened, so real mail never gets blocked by surprise.
• Looked after after launch: teams add new tools without telling anyone, and a regular look at DMARC reports catches them. That can sit inside a Care Retainer.
• Small changes handled, not invoiced: adding a new sending tool to your records gets done, not quoted.
• Honest advice: if the problem is the content of your emails or the quality of your list, a marketing specialist will help more than we can, and we will say so.

If you send to bought lists of addresses, we decline, because it damages your domain and breaks most providers' rules. If you send mail in very large volumes, a dedicated sending service may be the better answer, and we help you choose one.

Email touches almost every system you run. Website forms, online store order emails, SaaS receipts and CRM sequences all send as your domain, so they all need to be on the list. The rest of your domain, hosting and backups sit in Digital Infrastructure, and the same team keeps them in step.

The free health check covers SPF and DMARC along with website security settings and search basics, and the Digital Health Check goes further. When you are ready, tell us where your mail is going missing.