“Did you get my email?”
“No… oh wait, it was in my junk folder.”
If that conversation sounds familiar, you’re not alone. It’s one of the most common problems we get called about, and it’s more serious than it sounds. A quote that lands in junk is a quote that never gets read. An invoice that lands in junk is an invoice that doesn’t get paid.
The good news is that in most cases, the fix isn’t complicated. It usually comes down to three DNS records that most small businesses have either never set up, or set up once and never checked again: SPF, DKIM and DMARC.
Why This Matters More Than Ever
For years, plenty of businesses got away without these records. Their email mostly arrived, so nobody worried.
That’s changed. Over the last couple of years, the big email providers have tightened up considerably. Google and Yahoo now require senders to authenticate their email, with stricter rules for anyone sending in volume, and Microsoft has followed with similar requirements for Outlook.com and Hotmail addresses. Email that isn’t properly authenticated is far more likely to be junked, or rejected outright.
Meanwhile, criminals are sending more and more email that pretends to come from real businesses. These three records are also your main defence against someone spoofing your domain to scam your own customers.
SPF: Who Is Allowed to Send as You?
SPF (Sender Policy Framework) is a simple list, published in your domain’s DNS, of the services that are allowed to send email on your behalf.
If your business uses Microsoft 365, that’s one. But you might also send email from your website contact form, your accounting software, a booking system, a newsletter platform or your CRM. Every one of those needs to be in your SPF record, or receiving servers may treat those emails as suspicious.
The Common SPF Mistakes
- No SPF record at all
- Two separate SPF records on the same domain, which effectively breaks both
- A record that was set up years ago and doesn’t include newer services you’ve added since
- Going over the limit on DNS lookups, which causes the whole record to fail
DKIM: A Digital Signature on Every Email
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each email you send. The receiving server checks that signature against a public key in your DNS. If it matches, the receiver knows the email genuinely came from your domain and hasn’t been tampered with on the way.
In Microsoft 365, DKIM isn’t always switched on for your own domain by default. We regularly come across businesses that have used Microsoft 365 for years without it ever being enabled. It takes a few minutes to set up properly, and it makes a real difference.
DMARC: Tying It All Together
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with an email that claims to be from you but fails the SPF and DKIM checks. It has three main settings:
- None: monitor only, take no action
- Quarantine: send failing emails to junk
- Reject: block failing emails entirely
DMARC also sends you reports, so you can see who is sending email using your domain. That’s often eye-opening. It’s not unusual to discover a forgotten system sending invoices, or someone on the other side of the world trying to impersonate you.
The right approach is to start on “none”, read the reports, make sure every legitimate service is passing, and then gradually tighten the policy. Jumping straight to “reject” without that groundwork is a quick way to block your own invoices.
It’s Not Always the DNS
SPF, DKIM and DMARC fix the majority of deliverability problems we see, but not all of them. Other culprits include:
- Your domain or sending IP appearing on a blocklist
- Emails that look spammy: all images, one big link, “URGENT” in the subject line
- A compromised mailbox that’s been quietly sending spam, damaging your reputation
- Sending from a free email address like Gmail or Hotmail while trading as a business
That third one is worth highlighting. If a mailbox has been compromised, the problem isn’t just deliverability, it’s security. That’s why we always look at email security as a whole, rather than just patching DNS records.
How to Check Your Own Domain
If you want a quick idea of where you stand, there are free online tools that will look up your domain’s SPF, DKIM and DMARC records and flag obvious problems. Another simple test is to send an email to a personal Gmail address, open it, and choose “Show original”. Gmail will tell you whether SPF, DKIM and DMARC passed.
If you see “FAIL”, or no DMARC record at all, it’s worth getting it looked at.
Where FYDUS Comes In
We’re certified Microsoft partners and a Microsoft Cloud Solution Provider based in Eastbourne, and email is a huge part of what we do. When we look after your business email, we:
- Audit and correct your SPF, DKIM and DMARC records across every service that sends as you
- Enable and test DKIM signing in Microsoft 365
- Roll DMARC out safely, monitoring the reports before tightening the policy
- Configure Microsoft 365 security features like Safe Links, Safe Attachments and anti-phishing
- Check blocklists and sending reputation if problems persist
If your emails keep ending up in junk, or you’re simply not sure whether your domain is set up properly, we’re happy to take a look. You can also read more about our Microsoft 365 services.