Business Email Deliverability: SPF, DKIM and DMARC Explained
A clear guide to the three domain-authentication controls every organisation should understand before sending business or marketing email.
A professional email address does more than display your company domain. The domain must also prove that messages are authorised and have not been altered.
SPF, DKIM and DMARC work together to help receiving providers distinguish legitimate mail from spoofed or unauthorised messages.
Google introduced stricter requirements for bulk senders in 2024, including authentication, easy unsubscription and low reported-spam rates. The wider direction is clear: organisations need disciplined technical configuration and responsible sending practices.
SPF
Sender Policy Framework is a DNS record that identifies systems authorised to send email for a domain.
Important points:
- A domain should normally have one SPF record.
- All authorised senders must be included.
- Too many DNS lookups can invalidate the check.
- Removing an email platform should include updating SPF.
Businesses often send through business mailboxes, website forms, CRMs, accounting systems and marketing platforms. The complete sending inventory must be known.
DKIM
DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. The receiving server retrieves the public key from DNS and verifies the signature.
Each sending platform may use a different selector, allowing several authorised systems to sign for the same domain.
DMARC
DMARC adds policy and reporting on top of SPF and DKIM. It checks whether the authenticated domain aligns with the visible From domain and can instruct receivers to monitor, quarantine or reject failing mail.
Do not move directly to a strict reject policy without reviewing legitimate senders first.
Use a staged rollout
- List every sending system.
- Configure SPF.
- Enable DKIM.
- Publish DMARC in monitoring mode.
- Analyse reports.
- Correct misaligned senders.
- Move gradually to quarantine.
- Move to reject when confident.
- Continue monitoring.
Website forms need proper delivery
Contact forms often fail because the site sends mail using the visitor's address as the From address.
Use an authenticated company-controlled sender, place the visitor's address in Reply-To and test delivery to major providers.
Webz Fusion can connect Website Maintenance, Email Hosting and secure form delivery.
Marketing email adds further requirements
Authentication does not provide permission to send unwanted messages. Responsible campaigns need valid consent, clear sender identity, easy unsubscribe, accurate subject lines, suppression lists and complaint monitoring.
Protect domain reputation
Monitor bounce rates, spam complaints, sudden volume increases, compromised accounts, list quality and sending consistency.
Use strong authentication and secure the associated accounts.
Common mistakes
- Publishing multiple SPF records
- Leaving old platforms authorised
- Enforcing DMARC before monitoring
- Failing to authenticate website forms
- Ignoring DMARC reports
- Sending campaigns from a personal mailbox
- Buying contact lists
Webz Fusion provides Business Email Hosting, domain management and SSL as part of a connected business-web foundation.
Related Webz Fusion guides
- How to Choose and Protect a Domain Name for Your Singapore Business
- How to Migrate a Website Without Losing SEO, Email or Customer Trust
- Reseller Hosting for Agencies: Build Recurring Revenue Without Building a Data Centre
Need a practical recommendation for your website? Start a conversation with Webz Fusion.