Email & DNS
SPF, DKIM and DMARC explained for small businesses
SPF, DKIM and DMARC solve related but different email-authentication problems. Treating them as three copies of the same setting is a common source of broken mail.
SPF: which systems are allowed to send
SPF publishes a policy in DNS that receiving systems can use to evaluate whether a sending server is authorized for a domain. The correct record depends on every service that legitimately sends mail on the domain’s behalf.
Do not create multiple competing SPF records for the same hostname. When several services send mail, their authorization normally needs to be represented in one valid policy.
DKIM: a cryptographic signature on the message
DKIM allows a sending system to sign email. The receiving system retrieves the corresponding public key from DNS and verifies that the signed portions of the message validate.
DMARC: policy and alignment
DMARC builds on SPF and DKIM and introduces alignment with the domain visible to the recipient. It can also tell receivers how the domain owner wants messages handled when authentication does not align.
Roll out DMARC deliberately
Before applying a strict rejection policy, identify legitimate senders and make sure they authenticate correctly. Help desks, invoicing platforms, newsletters, CRMs, and website forms may all send mail for the same domain.
Authentication is not an inbox guarantee
Correct authentication is foundational, but delivery also depends on sender reputation, message quality, recipient behaviour, complaint rates, list hygiene, and provider policies.