Every service that sends email as your business: SPF, DKIM and DMARC in plain English
Your booking system, invoicing software and newsletter tool may all send email in your business's name. Receiving email services check whether each one is allowed to. If a tool isn't set up for your domain, its emails may be treated with suspicion.
This guide is for owners of small UK service businesses whose quotes, invoices, booking confirmations or newsletters sometimes land in spam, or who've been told "you need DMARC". It explains in plain English what SPF, DKIM and DMARC check, helps you list every service that sends email as you, and gives you questions to ask each provider and whoever manages your domain. It includes a blank sender register and a fictional worked example.
You don't need to edit any settings yourself, and this guide doesn't give you any. Authentication helps receivers decide whether to trust a message, but it doesn't guarantee delivery.
1. Authentication is one possible cause of spam problems
Email can land in spam for more than one reason. Authentication is one of them, not the only one.
If the problem is with your website's contact form, our guide to tracing a contact form that isn't sending emails covers that case in detail. It explains how forms can use the visitor's address as the sender, what "alignment" means, and what to ask your web supplier. This guide covers everything else that sends email as you.
2. List every service that sends as you
Start with a list. For a small service business, it might include:
- your mailbox, for staff email
- your website's contact or booking forms
- a booking or scheduling system that sends confirmations and reminders
- invoicing or accounting software that emails invoices
- a CRM or job system that sends updates
- a newsletter or marketing tool
Each of these may need its own set-up step for your domain. Microsoft's guidance on how email authentication works notes that many companies don't publish the relevant records because they don't know all of the email sources for their domain. A list is the first step to fixing that.
For each service, write down what it sends and which "From" address it uses. The register in section 6 gives you a format.
3. The three checks, simplified
These are simplified descriptions. Your provider or admin can tell you how they apply to your set-up.
- SPF. A list, published with your domain's settings, of the servers allowed to send email for your domain. Microsoft describes it as specifying the source email servers that are authorised to send mail for the domain.
- DKIM. A digital signature added to each message, using your domain. Microsoft says it signs important parts of the message so the receiving server can check the message wasn't altered in transit. It shows which domain signed the message. It doesn't prove which person wrote it.
- DMARC. Your published request to receiving services about what to do with a message that uses your domain in its "From" address but doesn't get an aligned SPF or DKIM pass, plus where to send reports. Google's guidance on setting up DMARC says that to pass DMARC, a message must pass SPF or DKIM, and that pass must line up with your domain. Receiving services decide what to do with your request.
What "aligned" means, and why it matters, is covered in the contact form guide.
4. What to ask each provider and your admin
For each service on your list, ask the provider:
- Which "From" address does your service use for our emails?
- Is it set up to pass SPF or DKIM in a way that aligns with our domain? What do you need from us?
- Who on our side needs to make any change, and how will we know it worked?
Then take the answers to whoever manages your domain's settings (DNS). That might be your email admin, your web supplier or your registrar account holder. Our guide to who controls your domain, hosting and website accounts helps you find out who that is.
Don't edit DNS settings yourself unless you manage them. A wrong change can affect all of your email, not just one tool.
If a provider asks you to "verify your domain" or "authenticate your domain", ask what records it adds and whether that makes its emails pass SPF or DKIM aligned with your domain.
5. DMARC policies and reports, without the jargon
A DMARC policy is the request you publish about messages that use your domain but fail DMARC. Google's DMARC guidance describes three options. Each one is a request, not an instruction receivers must follow:
- None: asks receivers to take no DMARC-based action on failing messages. It doesn't decide whether a message is delivered, and it doesn't produce reports by itself.
- Quarantine: asks receivers to treat failing messages as suspicious, for example by putting them in spam.
- Reject: asks receivers to refuse failing messages.
Whichever you choose, each receiving service makes its own decision and may apply its own other filtering. Reports are separate from the policy, as explained under "Reports" below.
Starting out. Google recommends that when you start using DMARC, you set the policy to none, then tighten it over time as you learn how your messages are being authenticated. That applies to a new set-up. If your domain already has a stricter policy, don't loosen it without advice from whoever manages it.
Reports. DMARC reports are summaries of authentication results that some receiving services send to an address you choose. They arrive only if your DMARC record asks for them, and only from receivers that send them. They show how messages using your domain were authenticated. They don't show whether each message reached an inbox. Someone needs to read them, or ask your provider for help reading them.
Gmail. Google's email sender guidelines set extra requirements, including DMARC, for bulk senders to personal Gmail accounts. If you send large volumes, check those guidelines.
6. Use the sender register
- Copy one register card for each service that sends email as you.
- Send each provider the three questions from section 4, and record the answers.
- Name who manages any setting that needs to change.
- Date each card, and check the list again when you add or replace a tool.
| Field | Your record |
|---|---|
| Service | |
| What it sends | |
| "From" address | |
| Provider's answer: set up for our domain (SPF or DKIM, aligned)? | |
| Who manages the setting | |
| Next step | |
| Checked on |
Fictional example
Fictional example only: an invented physiotherapy clinic and invented provider answers. It is not a ScalePass client, not a real configuration and not set-up advice.
The clinic listed five services and asked each provider the questions in section 4.
| Service | Provider's answer | Next step |
|---|---|---|
| Mailbox: staff email | Set up for the clinic's domain | None; email admin keeps the record |
| Booking system: confirmations | "Verify your domain" step not completed | Email admin completes the provider's step |
| Invoicing tool: invoices | Sends from its own domain on the clinic's behalf | Ask if it can send aligned with the clinic's domain |
| Website form: enquiry alerts | Uses the visitor's address; not aligned | Follow the contact form guide's supplier questions |
| Newsletter tool: monthly newsletter | Domain authenticated | None; office manager keeps the record |
This shows how the register works. It isn't a description of any real set-up.
Common questions
Do I need all three?
Google's guidelines ask everyone sending to personal Gmail accounts to set up SPF or DKIM, with extra requirements for bulk senders. Beyond that, ask whoever manages your domain what's appropriate. DMARC is built on an aligned SPF or DKIM pass.
Will this fix my spam problem?
It may help, if authentication is part of the cause. It isn't the only cause, and it doesn't guarantee delivery. Microsoft notes that delivery to Microsoft isn't guaranteed even for authenticated email from a sending platform.
Who should change our DNS settings?
Whoever manages your domain's settings, for example your email admin, web supplier or the person who holds the registrar account. If you're not sure who that is, find out before anything changes.
Our newsletter tool says "verify your domain". Is that this?
It may be. Ask the provider what records it adds, and whether that makes its emails pass SPF or DKIM aligned with your domain.
ScalePass helps service businesses connect and organise the tools they already use, with clear ownership of each one. If you'd like help listing the services that send email as you and working through the questions with your providers, see how we approach connected systems.
In short
List every service that sends email as your business. For each one, ask the provider whether it's set up to pass SPF or DKIM aligned with your domain, and who on your side needs to change anything. SPF lists allowed servers, DKIM signs messages with your domain, and DMARC asks receivers what to do with messages that fail and where to send reports. Start a new DMARC set-up by monitoring, but don't loosen an existing policy without advice. Leave DNS changes to whoever manages them, and remember that authentication helps but guarantees nothing.