Email Deliverability: SPF, DKIM and DMARC Fixes

Why business emails go to junk

Receiving mail servers decide whether to trust your message in seconds. They check whether the sending server is allowed to send for your domain (SPF), whether the message was signed and not altered (DKIM), and what your domain says should happen if those checks fail (DMARC). Missing or broken records mean your mail looks the same as a spoofed message.

dijitul support audits these records, reads real message headers, and fixes what is wrong. For general email problems see email support, or our main IT support page.

SPF: the most common mistakes

• Two SPF records. A domain can have only one TXT record starting v=spf1. A second one, often added by a new marketing tool, makes both invalid.
• Too many lookups. SPF allows a maximum of 10 DNS lookups. Each include: counts, and some include others. Microsoft 365 plus a CRM, an email marketing tool and a helpdesk can easily break the limit. We flatten or trim the record.
• Missing senders. Your website, accounting software or card machine may send email as your domain without being listed.
• Wrong ending. ~all (soft fail) is common while testing; -all (hard fail) is stricter once you are sure every sender is listed.

DKIM and DMARC

DKIM

DKIM adds a digital signature to every message. In Microsoft 365, custom domains need two CNAME records (selector1 and selector2) published, then signing switched on in the Defender portal. In Google Workspace you generate a key in the Admin console, publish a TXT record, then click Start authentication. Third-party senders such as Mailchimp or Xero have their own DKIM records too.

DMARC

A DMARC record at _dmarc.yourdomain ties SPF and DKIM to the address people see in the From line. We usually start with p=none and a reporting address so we can see every service sending as you. Once the reports are clean, we move to p=quarantine and then p=reject, which stops criminals spoofing your domain. See email security.

What the big mailbox providers now require

Since February 2024, Google and Yahoo have required anyone sending more than 5,000 messages a day to their users to have SPF, DKIM and a DMARC policy, one-click unsubscribe on marketing mail, and a low spam complaint rate. Microsoft introduced similar requirements for high-volume senders to Outlook.com addresses in 2025. Even if you send far fewer, these providers trust authenticated mail more, so every business benefits from getting it right.

If your website contact form sends from your domain using PHP mail on a web server, it will often fail these checks. We switch it to authenticated SMTP or a transactional email service. See website forms not working.

How we fix deliverability, step by step

1. We ask you to send a test email to a mailbox we control and read the full headers.
2. We list every service that sends as your domain: Microsoft 365 or Google Workspace, website forms, CRM, accounts software, newsletters.
3. We rebuild the SPF record to include them all within the 10-lookup limit.
4. We enable DKIM for your mail platform and each third-party sender that supports it.
5. We publish DMARC at p=none with reporting, review the reports after a week or two, then tighten the policy.

Blocklists, headers and price

We also check your sending IP and domain against major blocklists and read the Authentication-Results header on a real message to see exactly what the receiver decided. If an account has been compromised and used for spam, we deal with that first. See phishing protection.

Deliverability fixes are £45 an hour + VAT, with a 30-minute minimum then 15-minute blocks. Most domains are sorted in one to two hours, plus a follow-up once DMARC reports come in. Clients on the Complete plan at £99 a month + VAT can use their included hours. DNS edits need access to your registrar or DNS host; see domain and DNS support. Get in touch to start.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related