A client phones roughly once a month to say their invoices are landing in customers' spam folders. Almost every time, the cause is the same: the domain has no SPF record, no DKIM signing, and no DMARC policy. The mail is legitimate, but nothing about it proves that to the receiving server, so the receiving server guesses, and it guesses conservatively.
What the three records actually do
They are separate mechanisms that answer three different questions, and they are only useful together.
- SPF answers "is this server allowed to send mail for this domain?" It is a list of the servers you have authorised, published in DNS.
- DKIM answers "was this message altered in transit?" Your mail server signs each message with a private key, and the public key lives in DNS for anyone to verify against.
- DMARC answers "what should I do when the first two fail?" It also asks receiving servers to send you reports, which is how you find out who is forging your domain.
How to check yours in two minutes
Any DNS lookup tool will do it. Query your domain for a TXT record starting v=spf1, query _dmarc.yourdomain.co.za for a TXT record starting v=DMARC1, and check with your mail provider whether DKIM signing is switched on. In Microsoft 365 it is off by default on a custom domain, which surprises most people.
If DMARC is missing, anybody on the internet can send mail that appears to come from your finance department, and nothing will stop it.
The order to fix them in
SPF first, because it is the one most likely to be missing entirely. Then DKIM, which your provider will generate for you. Then DMARC, and start it at p=none so you get the reports without rejecting anything while you find the senders you had forgotten about: the accounting package, the CRM, the newsletter tool.
Leave DMARC on p=none for a month, read the reports, authorise everything legitimate, and only then move to p=quarantine and eventually p=reject. Going straight to reject is how a business stops its own invoices being delivered.
One thing that is not the problem
The content of your email. People rewrite subject lines for weeks trying to sound less promotional, when the actual issue is a missing TXT record that takes ten minutes to publish. Fix the authentication first; you will almost never need to look at the wording.