Email deliverability for small business: SPF, DKIM, and DMARC explained

Why good emails go to spam

Email’s original design lets anyone put any address in the From line — the way paper mail lets anyone write any return address on an envelope. Spammers and phishers exploit that constantly, so mailbox providers had to invent a way to tell authenticated senders from impostors. That system is three DNS records — SPF, DKIM, DMARC — published on your domain. Mail that passes them is verifiably yours; mail that doesn’t is, from Gmail’s point of view, indistinguishable from forgery.

The stakes changed materially when Gmail and Yahoo began enforcing authentication for senders — requiring SPF or DKIM for everyone, and DMARC for bulk senders — rather than merely preferring it. The practical result for a small business: an unauthenticated domain now fails silently. Your quote, your invoice, your appointment reminder goes to spam or is rejected, you get no error, and you conclude the customer is ignoring you. It is one of the most damaging silent failures in small-business operations precisely because nothing tells you it is happening.

The three records, in one table

They work as a system: SPF and DKIM each provide proof of legitimacy; DMARC ties both to the visible From address (“alignment”) and tells the world what to do with failures. Any one alone is incomplete — DKIM without DMARC, for instance, still lets a phisher send unsigned mail “from” your domain and leaves the receiver to guess.

SPF: the approved-senders list

SPF is one TXT record on your root domain listing every service that legitimately sends as you. A typical small business record looks like v=spf1 include:_spf.google.com include:sendgrid.net -all — “Google Workspace and SendGrid may send for me; everything else, reject.” The two mistakes that account for most SPF failures:

• Forgetting a sender. Your website’s contact form, your invoicing app, your CRM, your newsletter tool — each one that sends “from” your domain must be in the record, or its mail fails. Inventory every system that sends email before writing the record.
• Publishing two SPF records. The standard requires exactly one; a second (often left behind by an old provider) makes validation fail as a syntax error. Merge them into a single record. Also stay under the 10 DNS-lookup limit — each include: costs lookups, and exceeding ten breaks the whole record.

DKIM: the tamper-proof seal

DKIM has your mail server sign each outgoing message with a private key; the matching public key is published in your DNS, and receivers verify the signature. A valid signature proves two things at once: the mail genuinely comes from your domain, and nobody altered it in transit. Unlike SPF, it survives forwarding — which is why providers weight it heavily.

Setup is provider-specific but always the same shape: your mail provider (Google Workspace, Microsoft 365, your own mail server) generates the key pair and gives you a DNS record to publish — usually a TXT or CNAME at something._domainkey.yourdomain.com. Every sending service gets its own key: your newsletter tool and your CRM each publish their own DKIM selector alongside your main provider’s. Ten minutes per service, done once.

DMARC: the policy and the reports

DMARC is a TXT record at _dmarc.yourdomain.com that does two things: sets your policy for mail that fails authentication, and requests reports from receivers about who is sending as your domain. The policy has three levels, and the correct path is to walk up them:

1. Start at p=none — “deliver everything, but send me reports.” This changes nothing about delivery yet; it turns on visibility. Run it for two to four weeks and read the reports (a free DMARC report viewer makes the XML human-readable).
2. Fix what the reports reveal. Almost every business discovers a forgotten legitimate sender — the booking system, the scanner-to-email, the old newsletter tool — failing authentication. Add them to SPF/DKIM properly.
3. Move to p=quarantine, then p=reject once legitimate mail passes cleanly. At reject, forged mail claiming to be you is refused outright — which protects your customers from phishing sent in your name and, over time, your domain’s reputation.

Beyond the records: staying out of spam

• Separate your streams. Send marketing blasts from a subdomain (e.g. news.yourdomain.com) so a newsletter complaint spike can’t poison the reputation of the domain your invoices come from.
• Warm up new domains. A brand-new domain that suddenly sends 5,000 emails looks exactly like a spammer. Start small and ramp over weeks.
• Keep lists clean and consent real. High bounce rates and spam-complaint rates (Gmail’s enforcement threshold is a fraction of one percent) damage reputation faster than any record can repair.
• Route transactional mail through authenticated infrastructure. Website contact forms and order confirmations sent naively by a web server (PHP mail(), unauthenticated SMTP) are among the most common silent failures we find — the form “works” but the notification lands in spam. Wiring forms through a properly authenticated relay is standard in every build we ship and in the automation flows that send mail on your behalf.

The setup checklist

1. Inventory every system that sends email as your domain: mail provider, website forms, CRM, invoicing, newsletter, booking, scanners.
2. Publish ONE SPF record covering all of them; delete duplicates; stay under 10 lookups.
3. Enable DKIM at your mail provider and at each sending service; publish each key.
4. Publish DMARC at p=none with a reporting address; wait two to four weeks.
5. Read the reports, fix the forgotten senders they reveal, then step up to quarantine and finally reject.
6. Test the result: send to a Gmail address, open the message, choose “Show original,” and confirm SPF, DKIM, and DMARC all read PASS. Free tools like MXToolbox or Learndmarc give a second opinion.
7. Re-check whenever you add a sending service — the checklist is living, not one-time.

This is unglamorous infrastructure, which is exactly why it gets skipped — and why fixing it is often the highest-ROI hour in a small business’s marketing stack: every quote, invoice, and follow-up you send afterward actually arrives. It matters most where a single missed email is a lost job: professional services, trades, real estate, clinics sending appointment reminders. We run our own mail infrastructure and set this up as part of hosting and site builds — domain authentication included, verified with real test sends, not assumed. If you suspect your mail is quietly disappearing, get in touch and the audit takes a day. It also pairs with the lead-capture flows in our automation guide — an instant follow-up email is only instant if it lands in the inbox.