Published: 10.08.2026
If messages from your domain land in the spam folder, the cause is often a missing proof that the sender is genuine. Three DNS records solve this problem.
SPF: who may send
SPF is a TXT record that lists the servers allowed to send mail for your domain. Example:
v=spf1 mx include:_spf.example.net ~all
Keep a single SPF record, and stay under ten DNS lookups.
DKIM: a signature
The sending server signs each message with a private key. The public key is published in a TXT record under a selector, for example default._domainkey. The receiver checks that the message was not changed and was signed by your domain.
DMARC: the policy
DMARC tells receivers what to do when SPF and DKIM checks fail and sends you reports. Start with monitoring:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
After a few weeks of clean reports move to p=quarantine and then p=reject.
Step by step
- Find all services that send mail for your domain: the website, the newsletter and the mail server.
- Publish the SPF record that includes all of them.
- Enable DKIM in each service and publish the keys.
- Add DMARC with monitoring and read the reports.
- Tighten the policy gradually.
Other deliverability tips
- Make sure the reverse DNS (PTR) of the server IP matches the mail server name.
- Do not send from a free mailbox domain through your own server.
- Keep the lists clean and offer an unsubscribe link.
- Check that your IP is not on a blocklist.
Frequently asked questions
How long until the changes work? DNS updates are usually visible in minutes to hours.
Do I need all three? Large mailbox providers now expect them, especially for bulk senders.
