Website stewardship guide 13
If quotes, form alerts, or review requests from your business land in spam, the fix is often three DNS records: SPF, DKIM, and DMARC. Ask your provider to list every service that sends email as your business, publish those records, and start DMARC in monitoring mode.
← All website stewardship guidanceList every sender
Publish SPF
Turn on DKIM
Monitor with DMARC
Tighten gradually
Why this matters
Gmail, Yahoo, and Outlook.com check incoming mail for proof that the sender may use the domain. Mail without that proof is more likely to land in spam or be rejected. This affects more than newsletters. Website form alerts, quotes, invoices, and review-request emails are often sent by outside services using your domain.
The proof lives in DNS, the settings that direct your domain's traffic. SPF lists the services allowed to send as you. DKIM adds a digital signature to each message. DMARC tells receiving providers what to do when a message fails those checks, and sends you reports. Your provider can set up all three; you mainly need to know which tools send email for the business.
Responsible practices
Include your mailbox provider, website form, booking tool, invoicing or customer-management software, and any review-request or newsletter service. Each one needs to pass SPF or DKIM. A forgotten sender is the usual reason authenticated mail still fails.
SPF (Sender Policy Framework) is one DNS text record listing which services may send email for your domain. Your domain should have only one SPF record. When you add a sending service, update that record rather than creating a second one.
DKIM (DomainKeys Identified Mail) adds a signature that receiving servers check against a key published in your DNS. Most email and marketing services give you DKIM records to add. Turn it on for every service that supports it, not just your main mailbox.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do with mail that fails SPF and DKIM. It also sends reports showing who is sending as your domain. Start with p=none, which only monitors. Once every real sender passes, your provider can move to p=quarantine (failures go to spam), and later p=reject.
Since February 2024, Google and Yahoo have required every sender to use SPF or DKIM. Bulk senders, which Google defines as close to 5,000 or more messages a day to Gmail accounts, must use SPF, DKIM, and DMARC and offer one-click unsubscribe on marketing mail. Since May 2025, Outlook.com has applied similar rules to high-volume senders. Most small businesses send far less, but the basic rule still applies.
Worked example
Hypothetical example: a plumbing company's website form emails the office for each new request. Staff start finding those alerts in the spam folder.
Most delivery problems come from a sender nobody listed. Update the sender list whenever you add a tool that emails customers.
Email authentication
List every tool that sends email using your business domain.
Send a test message to a Gmail address and check whether it reaches the inbox.
Ask your provider whether SPF, DKIM, and DMARC cover each sender.
Choose who receives DMARC reports, or which reporting service reads them for you.
Publish or correct one SPF record that covers every approved sending service.
Turn on DKIM signing for the mailbox provider and each outside service that sends as the business.
Publish a DMARC record at p=none, review the reports, and recommend when to tighten the policy.
Avoid these failures
Good website care lowers risk, but no provider can guarantee uninterrupted service.
Questions business owners ask
Yes. Google and Yahoo expect every sender to use SPF or DKIM, and DMARC makes it harder for others to send fake email in your name. Setup is usually a one-time job with updates when you add a tool.
Often the form sends mail "from" your domain through a server that isn't in your SPF record and doesn't sign with DKIM. Ask your provider to send form mail through an authenticated email service.
Not at p=none, which only reports. Problems appear when the policy is tightened before every legitimate sender passes. That is why you start by monitoring.
No. It shows the mail really comes from you. Content, sending volume, and spam complaints also affect where messages land.
Primary guidance
Plan the next step