SPF, DKIM and DMARC explained — why your business email lands in spam (and the 20-minute fix)

Key takeaways

SPF says which servers may send for your domain. DKIM signs each message so receivers can verify it was not altered. DMARC tells receivers what to do when SPF/DKIM fail — and sends you reports.
Since February 2024, Google and Yahoo require SPF + DKIM + DMARC for anyone sending 5,000+ messages/day and strongly enforce it for everyone. Missing DMARC is now the most common reason legitimate Indian business mail is filtered.
The four mistakes we see most: two SPF records (fatal), more than 10 DNS lookups in SPF (fatal), DKIM "enabled" in the provider but the DNS record never published, and DMARC at p=none forever.
The fix takes 20 minutes if you know your mail provider. Check your domain first with our DNS, email & security check.

1. The three records, in one picture

You send mail ──► Receiver (Gmail) asks DNS:
   SPF   TXT @           "Is this sending IP allowed for suzu-example.com?"
   DKIM  TXT selector._domainkey  "Does the signature verify with this public key?"
   DMARC TXT _dmarc      "If either fails, do I reject / quarantine / nothing? Where do I send reports?"

2. SPF

A TXT record on the bare domain:

v=spf1 include:_spf.google.com ~all

include: pulls in your provider's servers. One per provider that sends as your domain (Google Workspace, Zoho, your CRM, Mailchimp, your website's PHP mail).
~all = soft-fail (mark suspicious), -all = hard-fail (reject). Start with ~all, move to -all after DMARC reports are clean.
Limit: 10 DNS lookups. Each include, a, mx, redirect costs one — nested includes count too. Exceed it and SPF returns permerror, which is worse than no SPF.
Exactly one SPF record. Two records = permerror.

3. DKIM

Your provider generates a key pair; you publish the public key at selector._domainkey.yourdomain:

Provider	Selector(s)	Where to find the record
Google Workspace	`google`	Admin console → Apps → Gmail → Authenticate email
Microsoft 365	`selector1`, `selector2` (CNAMEs)	Defender portal → Email authentication → DKIM
Zoho Mail	`zmail` or custom	Zoho Mail admin → Email authentication → DKIM
Hostinger / Titan	provided in hPanel Emails → DKIM	hPanel
Mailchimp / SendGrid / Brevo	`k1`,`k2` / `s1`,`s2` / `mail`	Sending domain settings

Enabling DKIM in the provider without publishing the DNS record is the single most common gap we find. Verify with the tool: it probes 45 common selectors.

4. DMARC

A TXT record at _dmarc.yourdomain:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain; pct=100; adkim=r; aspf=r

p=none — monitor only (start here for 2 weeks). p=quarantine — send failures to spam. p=reject — refuse them (the goal).
rua= — aggregate reports (daily XML; use a free DMARC report viewer or your mail provider's dashboard).
Alignment: the From: domain must match the SPF domain or the DKIM d= domain. This is why "we use SendGrid and it still fails" happens — the DKIM d= must be your domain, not the vendor's.

5. Copy-paste records by provider

Google Workspace

@      TXT  v=spf1 include:_spf.google.com ~all
google._domainkey  TXT  (value from Admin console)
_dmarc TXT  v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain

Microsoft 365

@      TXT  v=spf1 include:spf.protection.outlook.com ~all
selector1._domainkey  CNAME selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
selector2._domainkey  CNAME selector2-yourdomain-com._domainkey.yourtenant.onmicrosoft.com
_dmarc TXT  v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain

Zoho Mail

@      TXT  v=spf1 include:zoho.in ~all
zmail._domainkey  TXT  (value from Zoho admin)
_dmarc TXT  v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain

Hostinger email

@      TXT  v=spf1 include:_spf.mail.hostinger.com ~all
(DKIM record from hPanel → Emails → DKIM)
_dmarc TXT  v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain

If your website sends mail (contact forms via PHP mail()), either route it through your provider's SMTP or add the hosting server's include — otherwise form notifications fail DMARC.

6. Beyond the three: MTA-STS, BIMI, CAA

MTA-STS + TLS-RPT force TLS for inbound mail — recommended for regulated businesses.
BIMI shows your logo in Gmail — requires p=quarantine or reject and a verified mark certificate (expensive; skip unless brand-heavy).
CAA is not email, but publish it anyway: it stops random CAs issuing certificates for your domain.

7. Checklist

Run the domain check.
One SPF, ≤10 lookups, ends in ~all (then -all).
DKIM record published and verified for every sender.
DMARC p=none with rua= → review reports for 14 days → p=quarantine → p=reject.
Re-run the check; keep the report.

Email landing in spam is a revenue problem. We fix it in a day and keep it fixed as part of Managed IT.