One of your regular customers gets an email from your company address. Your logo, your signature, your usual tone. It says your bank details have changed and asks them to pay this month’s invoice into a new account.
They pay. You never sent it.
Patricia Highsmith’s Tom Ripley gets away with being someone else because nobody thinks to check. If your domain has no DMARC record, nobody checks your emails either, so that email is surprisingly easy to fake, and for a Nigerian business whose customers pay by bank transfer, it’s a real risk. The same gap causes a second problem. Your genuine emails, sent to people who asked for them, land in spam or vanish, because your domain never proved they came from you.
Three records fix both problems. SPF, DKIM and DMARC are how Gmail, Yahoo and the rest check that an email claiming to come from your business really did. Each has one job, and the order you switch them on matters, because DMARC rolled out carelessly can block your own invoices.
You’ll need access to your domain’s DNS settings, or someone who has it. For the wider picture of reaching the inbox, read the email deliverability guide alongside this one.
The Rules Changed in 2024
Since 2024, Google and Yahoo have required bulk senders, meaning anyone sending large volumes to their users, to authenticate email with SPF, DKIM and DMARC, offer easy one-click unsubscribe, and keep spam complaints low. Smaller senders benefit too. Authenticated email earns more trust, and unauthenticated email gets less of it every year.
Three Records in Plain English
SPF answers whether a server is allowed to send email for your domain. Think of it as your company’s list of approved couriers. DKIM answers whether a message was really signed by your domain and arrived unchanged, like a tamper-evident seal on the envelope. DMARC tells receivers what to do when SPF or DKIM fails, and who to tell about it. It’s your instruction to the post office about suspicious mail.
All three are published as text (TXT) records in your domain’s DNS settings, which you manage through your domain registrar or hosting provider.
First, Find Everyone Sending as You
This step prevents most authentication mistakes. Businesses usually send email from more places than they realise.
- Your main mailbox provider (for example, Google Workspace, Microsoft 365, or your web host’s email)
- Your email marketing platform
- Your website, for form notifications and order emails
- Your CRM, helpdesk or invoicing software
- Any SMS or WhatsApp platform that also sends email
Every one of these has to be authorised, or its email will fail once you enforce DMARC. Each provider publishes exact instructions for which records to add. Follow them instead of guessing.
SPF, the Approved Couriers List
SPF is a single TXT record at your domain’s root, listing the services allowed to send email for your domain. A typical one looks like this.
v=spf1 include:_spf.google.com include:yourmailplatform.com ~allv=spf1identifies it as an SPF record.- Each
include:authorises a sending service. Your providers tell you exactly what to include. ~alltells receivers that anything not listed should be treated as suspicious (a “soft fail”).-allis stricter and means reject.
Two SPF rules people break
- One SPF record per domain, never two. If you add a second record for a new service instead of adding an
includeto the existing one, both can fail. Combine them into one. - Ten DNS lookups, maximum. Each
includecan trigger several. Businesses using lots of sending services can blow past the limit, and then SPF fails. If that’s you, check your record with an SPF checking tool and trim where you can.
DKIM, the Tamper-Proof Seal
DKIM adds a digital signature to every email. Your sending service creates a pair of keys. It keeps the private key to sign messages and gives you the public key to publish in your DNS, so receivers can check the signature.
- In each sending service’s settings, find the DKIM or domain authentication section.
- The service gives you a record name (usually containing a “selector” followed by
._domainkey) and a value, which is either a long public key or a CNAME pointing to the provider. - Add that record in your DNS exactly as given.
- Return to the service and verify or activate DKIM signing.
Unlike SPF, you can have several DKIM records, one per service, because each uses its own selector. Set up DKIM for every service that sends as your domain.
DMARC, Slowly
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with email that fails authentication, and where to send reports.
One rule matters more than the rest. Start in monitoring mode, and only tighten the policy once you’re sure all your legitimate email passes. Jump straight to a strict policy and you can block your own invoices and notifications.
| Stage | Record | What it does | When to move on |
|---|---|---|---|
| 1. Monitor | v=DMARC1; p=none; rua=mailto:[email protected] | Takes no action, and sends you reports on who is sending as your domain | After a few weeks of reports showing all legitimate services pass |
| 2. Quarantine | v=DMARC1; p=quarantine; rua=mailto:[email protected] | Failing email goes to spam | After a period with no legitimate email affected |
| 3. Reject | v=DMARC1; p=reject; rua=mailto:[email protected] | Failing email is refused outright | Your long-term goal, for the strongest protection against impersonation |
Reading DMARC reports
The rua address receives aggregate reports, which arrive as compressed data files nobody wants to read raw. A DMARC report analysis service (many have free tiers) turns them into readable summaries showing which services sent email as your domain and whether each one passed. Use the monitoring stage to find the services you forgot, then fix them before tightening your policy.
Alignment, briefly
DMARC needs SPF or DKIM to pass, and the domain they authenticate also has to match the domain in the visible “From” address. That’s why some marketing platforms ask you to set up a custom sending or return-path domain. Without it, a message can pass SPF for the platform’s domain and still fail DMARC for yours. Complete your platform’s domain authentication steps in full.
Check Your Work
- Use an online DNS lookup or email authentication checker to confirm your SPF, DKIM and DMARC records are published correctly.
- Send a test email from each service to a Gmail address. Open it in Gmail and choose to show the original. You’ll see SPF, DKIM and DMARC results, and all three should say PASS.
- Review your DMARC reports weekly during the monitoring stage.
- Check again whenever you add a new service that sends email as your domain.
Authentication Gets You to the Door
Authentication is necessary, and on its own it isn’t enough. Receivers also look at your list. Sending to invalid or abandoned addresses damages your reputation, so verify lists before sending and remove people who never engage. They look at consent, because people who never asked for your email are the ones who mark it as spam; the consent wording guide covers collecting permission properly. They look at complaint rates, so keep them very low and make unsubscribing easy, including one-click unsubscribe for marketing email. And they look at consistency. Sudden huge sends from a new domain look suspicious, so build volume gradually.
A Worked Example
Here’s a typical small business setup, using the placeholder domain example.com. The business uses Google Workspace for staff email, an email marketing platform for newsletters, and a WordPress website that sends form notifications.
| Record | Name | Value (illustrative) |
|---|---|---|
| SPF | example.com | v=spf1 include:_spf.google.com include:[your marketing platform’s SPF domain] ~all |
| DKIM (Google Workspace) | google._domainkey.example.com | The public key generated in the Workspace admin console |
| DKIM (marketing platform) | The selector your platform gives you, followed by ._domainkey.example.com | The key or CNAME your platform gives you |
| DMARC | _dmarc.example.com | v=DMARC1; p=none; rua=mailto:[email protected] |
There’s one SPF record listing both services, and a separate DKIM record for each. The website doesn’t appear in the SPF record at all, because, as you’re about to see, it should send through Google Workspace instead of straight from the web server.
The Booking Confirmation That Never Arrived
WordPress and many other website platforms send email straight from the web server by default. That server usually isn’t authorised in your SPF record and doesn’t sign with your DKIM key, so form notifications, order confirmations and password resets fail authentication. They land in spam or disappear, and nobody notices until a customer says they never got their booking confirmation.
Send website email through an authenticated service instead.
- Install an SMTP plugin on WordPress and connect it to your authenticated mailbox provider, or to a transactional email service.
- Send from an address on your own domain, such as
[email protected]. A free email address won’t authenticate as your business. - Test by submitting your own forms and checking the authentication results in Gmail, as described above.
This one change fixes a surprising number of “our customers never get our emails” complaints.
Keep Marketing Email Off Your Main Domain
If you send a lot of marketing email, consider sending it from a subdomain such as news.example.com, while staff email stays on example.com. Each builds its own sending reputation, so a campaign that attracts complaints won’t drag down the delivery of everyday business email and invoices. Authenticate the subdomain with its own SPF and DKIM records. Your DMARC record can set a policy for subdomains using the sp= tag.
When Something Fails
| Problem | Likely cause | Fix |
|---|---|---|
| SPF shows “permerror” | Two SPF records, or more than ten DNS lookups | Merge into one record and remove services you no longer use |
| DKIM fails | Record copied incorrectly, wrong selector, or a long key split badly by the DNS provider | Recopy the record exactly, and check your DNS provider’s guidance for long TXT values |
| SPF and DKIM pass, but DMARC fails | Alignment. They passed for the platform’s domain and failed for yours | Complete your platform’s custom domain or return-path setup |
| A service you forgot fails after enforcing DMARC | It was never authorised | Add its SPF include and DKIM record. This is why the monitoring stage matters |
| Everything passes, but email still goes to spam | Reputation, list quality or content | Clean your list, send only to people who opted in, reduce complaints, and review content |
The Bonus Round
Once your DMARC policy reaches enforcement (quarantine or reject), look at BIMI. It lets supporting email providers show your logo next to your emails in the inbox, which is a nice visible trust signal. It needs a correctly formatted logo file and, for some providers, a paid verification certificate. You don’t need it, but it’s a worthwhile next step once everything else is in place.
Do It in One Afternoon
List every service that sends email as your domain. Add one combined SPF record. Set up DKIM in each service. Publish a DMARC record at p=none with a reporting address. Send test emails to Gmail and confirm all three pass. Then, over the following weeks, review the reports and tighten DMARC to quarantine and eventually reject.
About That Fake Invoice
At p=reject, the forged email from the start of this guide gets refused before it ever reaches your customer’s inbox. That alone is worth an afternoon with your DNS settings.
If emails are still going missing after all this, the problem may be bigger than authentication. The free 2-minute diagnostic shows which of your four walls is weakest, and email that doesn’t reach people usually shows up under Retain.
Spending ₦1M or more a month on marketing? You also qualify for a free 30-minute Leak Check, with no card and no obligation.
Mailbox provider requirements and DNS details change and vary by provider, so follow your email and DNS providers’ current documentation. Incorrect DNS changes can disrupt email delivery. If you’re unsure, have a qualified technician make them.
This article covers one part of a bigger system. Our guide to digital marketing in Nigeria shows how the four walls fit together, and the order to build them in.
