SPF, DKIM and DMARC: why your emails land in spam

Why it matters at all

Email was born when everyone knew each other and originally had no way to verify the sender. That's why the "From" address is still easy to forge. SPF, DKIM and DMARC are three layers that prove to the receiving server that a message really comes from your domain.

When they're missing, two things happen: your legitimate email lands in spam, and attackers can send fraud in your name. Google and Microsoft now require authentication outright.

SPF — who may send for your domain

SPF is a list of servers allowed to send for your domain. It's a single TXT record. For Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Add other services via include:. The trailing -all means "reject everything else".

DKIM — a digital signature on the message

DKIM adds a cryptographic signature to every message. The receiving server uses the public key in your DNS to verify nothing was altered in transit. In Microsoft 365 you enable DKIM and add two CNAME records.

DMARC — what to do on failure

DMARC ties SPF and DKIM together, tells the server what to do on failure, and sends you reports. A monitor-only starting record:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

• none — monitor only. Always start here.
• quarantine — send suspicious mail to spam.
• reject — reject suspicious mail. The target state.

Never switch DMARC straight to reject. Monitor first to discover every legitimate service that sends on your behalf.

Recommended rollout

1. Deploy a correct SPF record covering all your senders.
2. Enable DKIM and add the generated records.
3. Add DMARC in p=none mode.
4. After a few weeks, review reports and add missing sources.
5. Move to quarantine and finally reject.