SPF, DKIM and DMARC in plain words: why your mail goes to spam

Published 2026-11-03 · 6 min read · By the Alian Digital team

If your messages land in spam or you get spoofed, the cause is usually that the domain does not confirm who may send mail on its behalf. Three DNS records fix that.

SPF: who may send

SPF is a TXT record in DNS with a list of servers and services allowed to send mail from your domain. The receiving server checks whether the sender is on the list.

DKIM: the signature

DKIM adds a digital signature to each message. The public key sits in DNS and the recipient checks the message was not altered and truly comes from your domain.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM together and sets a policy: do nothing (none), quarantine or reject. It also sends reports on who writes on your behalf and from where.

Where to start

• List everyone who sends mail: mailboxes, CRM, newsletters, the site, accounting.
• Add SPF with all legitimate senders.
• Enable DKIM in every service and add the keys to DNS.
• Add DMARC with p=none and an address for reports.
• Read the reports for a few weeks and fix the sources that fail.
• Only then move to quarantine and, if needed, reject.

Common mistakes

• Several SPF records instead of one.
• Forgetting newsletter services and the CRM.
• Going straight to p=reject and losing your own mail.
• Forgetting to update records after changing mail or hosting.