SPF, DKIM and DMARC explained for small businesses

Why they matter

Anyone can put your domain in the “From” line of an email. SPF, DKIM and DMARC let receiving servers check whether a message really came from you. Without them your genuine email is more likely to land in spam, and criminals find it easier to impersonate you.

SPF: who may send

SPF is a DNS record listing the servers allowed to send email for your domain, for example your email provider and your invoicing system. Rules to know: a domain should have one SPF record only, and SPF allows a maximum of 10 DNS lookups, after which it fails.

DKIM: a signature on each message

Your email provider adds a cryptographic signature to each message. The matching public key sits in your DNS under a name called a selector. Receivers use it to check the message was not altered and really came from your provider. Your provider gives you the record to publish.

DMARC: what to do when checks fail

DMARC tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. The policy can be none (just report), quarantine (send to spam) or reject (refuse).

A safe order to set them up

1. Make sure SPF lists every service that sends email as you.
2. Turn on DKIM signing with each of those services.
3. Publish DMARC with p=none and a reporting address, and read the reports.
4. Fix any legitimate senders that fail, then move to quarantine and finally reject.

What these checks don’t tell you

Correct records make delivery more likely but do not guarantee it. Content, sending reputation and blacklists also matter; see why business emails go to spam.

Pingee checks these records for you on an ongoing basis. See email health checks.

Written by the Pingee team. Last reviewed 12 October 2026.