SPF, DKIM and DMARC so inboxes trust you
We find every service that sends mail as your domain, authenticate each one, then move DMARC from monitoring to enforcement without losing real mail.
In plain English.
Three DNS records decide whether Gmail and Outlook trust mail from your domain. SPF lists the servers allowed to send it. DKIM adds a signature to each message that receivers check against a public key in your DNS. DMARC, the record that tells inboxes what to do with mail that fails the checks, ties the two to the address your customers see.
Since February 2024, Google and Yahoo have required anyone sending 5,000 or more messages a day to their users to have SPF, DKIM and DMARC in place, and every sender needs at least SPF or DKIM. Smaller senders feel the effect too: unauthenticated invoices and quotes land in spam, and anyone can spoof your address without a DMARC policy.
The hard part is the senders you forget: your accounting package, website contact form, booking system or newsletter tool. Each needs to be in SPF or signing with DKIM on your domain. We start DMARC at p=none, read the reports to find every source, fix them, then move to quarantine and finally reject.
It suits you if.
- Your quotes, invoices or contact form replies land in spam
- Someone has been sending phishing emails using your domain
- You send newsletters and need to meet Google and Yahoo sender rules
- Your SPF record has grown long and fails with a permerror
- A customer or insurer asked if your domain has DMARC at p=reject
What we do.
SPF within the 10-lookup limit
SPF allows at most 10 DNS lookups from include, a, mx, ptr, exists and redirect. Go over and receivers return permerror. We count yours and trim or restructure the record to fit, with one v=spf1 record only.
DKIM for every sender
Each service signs with its own selector, published at selector._domainkey on your domain, such as google for Workspace or selector1 and selector2 for Microsoft 365. We use 2048-bit keys where the sender supports them.
DMARC rolled out in stages
p=none to collect aggregate reports, then p=quarantine to send failures to spam, then p=reject so receivers refuse them outright. Subdomains are covered with sp=.
Alignment with your From address
DMARC passes only when SPF or DKIM passes on a domain that matches the visible From address. We set custom return-path and DKIM domains on third-party senders so they align.
Correct MX records
MX records pointed at your real mail provider with sensible priorities, and a null MX plus v=spf1 -all on domains that should never send or receive mail.
Reports you can read
DMARC aggregate reports are XML files that few people open. We collect them, read them and summarise which sources pass, fail or need fixing.
How it runs.
- 01
Find the senders
We check your current records, ask which tools send email for you, and publish DMARC at p=none with reporting so the reports reveal the rest.
- 02
Authenticate each one
Every legitimate sender is added to SPF or set to sign with DKIM on your domain, with alignment checked against the From address.
- 03
Tighten the policy
Once the reports show your real mail passing, we move to p=quarantine, watch the results, then to p=reject.
- 04
Keep it right
When you add a new tool that sends mail, we add it to SPF or DKIM before it goes live, so your policy never catches your own mail.
Questions people ask.
How long does it take to reach p=reject?
Usually several weeks. The records go in on day one, but we need a few weeks of DMARC reports to be sure every genuine sender passes before enforcing. Moving to reject too soon blocks your own invoices or newsletters, so we let the reports set the pace.
Will DMARC stop phishing emails that use my domain?
At p=reject, receivers that honour DMARC refuse mail that claims to be from your exact domain but fails the checks, which stops direct spoofing. It cannot stop lookalike domains with a letter changed, so we also check for those and can register the obvious ones.
What do you need from me?
Access to your DNS, a list of the tools you think send email for you, and admin access, or a contact, for each one so we can enable DKIM. The DMARC reports will show anything you forgot, and we will ask you about each unknown source before blocking it.
What does SPF, DKIM and DMARC set-up cost?
It is a fixed price agreed after a free call, based on how many services send mail for you. Monitoring DMARC reports after enforcement can be added for a monthly fee agreed up front. The DNS changes themselves carry no third-party charge.
Your next chapter starts with a conversation.
Nottingham & Derby / UK-wideLet’s build
what’s next.
15 minutes with Garreth.
A real conversation about your business.