You send an invoice. The client never gets it. You check — it’s in spam. Or worse: it was quietly rejected and nobody knows.
Nine times out of ten the reason is the same: you haven’t told the world who is allowed to send email on your behalf.
The problem it all starts with
The email protocol is old and trusting by nature. Any server in the world can send a message that says “from: you@yourcompany.com” — just as anyone can write someone else’s address on an envelope.
That is why Gmail, Outlook and the rest ask for proof. That proof is the three records below.
SPF — who may send
A list of servers authorised to send on behalf of your domain. If an email comes from a server that is not on the list, the recipient knows something is wrong.
It looks like this:
v=spf1 include:_spf.your-hosting.com ~all
The most common mistake: two SPF records on the same domain. That is not “double protection” — it is an invalid configuration and both are ignored. If you use both your hosting and Google Workspace, they are merged into one record with two includes.
DKIM — a signature that can’t be forged
When sending, the server puts a cryptographic signature in the header. The recipient checks it against the public key published in your DNS.
If someone alters the message on the way, the signature doesn’t match. If someone pretends to be you — there is no signature at all.
The key is generated by your hosting or email provider; you just copy it into DNS.
DMARC — what the recipient should do when something is wrong
SPF and DKIM only check. DMARC says what happens next:
v=DMARC1; p=none; rua=mailto:you@yourcompany.com
- p=none — just report to me, don’t reject anything
- p=quarantine — put it in spam
- p=reject — reject it completely
Start with none. It blocks nothing, but sends you weekly reports on who is sending in your name. You will be surprised — there is often an old CRM, a website form or accounting software you forgot about.
Once you see that everything legitimate passes, move to quarantine, and only then to reject. The reverse order means blocking your own emails.
How long it takes
Entering the records takes fifteen minutes. DNS propagation — up to 24 hours, usually less.
To check: send an email to check-auth@verifier.port25.com and you will get back a report on all three records.
If all this looks like a lot
With us, these records are set up when your hosting is activated. If your email ends up in spam, get in touch — the check takes a few minutes.
All our plans include unlimited email addresses, with SPF and DKIM set up.
Web hosting →