SPF, DKIM and DMARC: why your email stopped arriving

If your email has become less reliable over the last two years — quotes not arriving, newsletters landing in spam, customers saying “I never got that” — the cause is probably not your provider. It is a change in the rules that most small businesses never heard about.

What changed, and when

Google and Yahoo announced joint requirements in October 2023 and began enforcing them in February 2024. Microsoft followed, rejecting non-compliant bulk mail from May 2025. As of November 2025, non-compliant mail receives permanent rejections rather than being filtered.

That distinction matters enormously. Being filtered to spam means the message arrived and nobody looked. Being rejected means it never arrived at all — and the bounce may not be somewhere you check.

The formal threshold is 5,000 messages a day to any one provider, which sounds like it excludes you. It probably does, technically. But all three providers recommend the same authentication for every sender regardless of volume, and the reported gap is stark: compliant senders averaged 89% inbox placement in 2026, against 22–34% of non-compliant mail being routed to spam.

Meanwhile only about 16% of domains have DMARC implemented at all. Being in the compliant minority is a genuine deliverability advantage right now.

The three records, in plain English

All three are DNS records on your domain. None require touching your website.

SPF — a list of who is allowed to send email claiming to be you. Your mail provider, your newsletter tool, your booking system, your accounting software. If a server not on the list sends as you, that is a signal it is forged.

DKIM — a cryptographic signature on each message, proving it genuinely came from your domain and was not altered on the way. Your provider generates the key; you publish the public half in DNS.

DMARC — the policy that ties the other two together. It tells receiving servers what to do when a message fails: nothing, quarantine, or reject. It also asks them to send you reports on who is sending as you, which is how you find out about spoofing.

SPF and DKIM are the evidence. DMARC is the instruction about what to do with it.

The order to do it in

Do not skip to the end. A DMARC policy of reject published before SPF and DKIM are correct will reject your own legitimate email.

1. List every service that sends email as you. This is the step people get wrong. Your mail provider, obviously — but also the newsletter platform, the CRM, the invoicing tool, the website contact form, the booking system, the review-request tool. Anything that sends with your address on it.
2. Publish one SPF record covering all of them. Exactly one — the specification allows a single SPF record per domain, and adding a second invalidates both rather than extending the first. This is the most common misconfiguration we find.
3. Enable DKIM at each service that supports it and publish the keys they give you.
4. Publish DMARC at p=none with a reporting address. This changes nothing about delivery — it just starts the reports flowing.
5. Read the reports for a few weeks. You will discover senders you had forgotten. Fix those.
6. Move to quarantine, then reject once the reports are clean.

That last progression is the part worth being patient about. Rushing from nothing to reject in an afternoon is how a business stops its own invoices from arriving.

What else the providers now require

Authentication is not the whole list. Also expected:

• One-click unsubscribe on marketing email, honoured within two days.
• Spam complaints below 0.3%. Three complaints per thousand messages is the ceiling, and it is easier to breach than it sounds if you email people who forgot they signed up.
• Sending from your own domain, not from a free address. Sending marketing as @gmail.com now actively fails authentication checks.

Two things worth knowing

This also protects your customers. Without DMARC, anyone can send email that appears to come from your address — invoice fraud, fake quotes, phishing aimed at people who trust you. Publishing a policy of reject is what stops that being trivially easy.

You may already be partly done. Google Workspace and Microsoft 365 set up SPF and DKIM during onboarding. DMARC almost never gets published, because it is the step that requires a decision rather than a default.

How to check where you stand

Send a message to a Gmail address you control, open it, and use “Show original”. You want to see PASS against SPF, DKIM and DMARC. Anything else is worth fixing, and none of it costs anything but attention.

We set these up as part of any build and will audit an existing setup on a free call. If email is a real channel for you, the five emails worth running is only useful once the messages actually arrive — and DNS explained covers where these records live.