Sound familiar?
- People are getting emails that appear to come from your domain but did not
- Your invoices land in customers' junk folders
- Gmail shows a warning or rejects your messages
- You have two SPF records, or one with 'too many DNS lookups'
- Your website contact form emails never arrive
- A mailbox has been forwarding copies of everything to an unknown address
Key facts
- SPF lists who may send for your domain; it must stay under the 10 DNS lookup limit
- DKIM signs each message so receivers can check it was not altered
- DMARC tells receivers what to do with mail that fails, and sends you reports
- Google and Yahoo require SPF, DKIM and DMARC from senders of more than 5,000 messages a day; Microsoft followed for Outlook.com from 5 May 2025
- We move DMARC from p=none to quarantine or reject in stages, checking reports so real mail is not blocked
- One-off setup: £45 an hour + VAT; Complete plan: £99 a month + VAT
The three DNS records every business domain needs
Email was designed without any way to prove who sent a message. SPF, DKIM and DMARC are DNS records that add that proof. Without them, anyone can send email that claims to be from accounts@yourbusiness.co.uk.
| Record | What it does | Common mistake |
|---|---|---|
| SPF | Lists the servers allowed to send for your domain | Two SPF records, or more than 10 DNS lookups, which makes SPF fail entirely |
| DKIM | Adds a cryptographic signature to each message | Enabled for Microsoft 365 but not for Mailchimp, Xero or your website |
| DMARC | Tells receivers to accept, quarantine or reject mail that fails, and sends you reports | Left at p=none forever, so spoofed mail is still delivered |
Why this matters more now
Since February 2024, Google and Yahoo have required senders of more than 5,000 messages a day to their users to have SPF, DKIM and a DMARC policy, and Microsoft introduced the same requirement for Outlook.com, Hotmail and Live addresses from 5 May 2025. Even if you send far fewer emails, the big providers increasingly treat unauthenticated mail with suspicion, so a missing record can mean your quotes and invoices quietly land in junk. See email deliverability if that is your main problem.
A DMARC policy of quarantine or reject is also the main defence against criminals sending fake invoices that look like they came from you.
How we set it up without breaking your email
- Inventory: we find everything that sends as your domain: Microsoft 365 or Google Workspace, accounting software, CRM, newsletter tools, the website contact form, the photocopier's scan-to-email.
- SPF: one record, flattened if needed to stay under 10 lookups, ending in ~all or -all.
- DKIM: enabled in Microsoft 365 (two CNAME records) or Google Workspace, plus each third-party sender that supports it.
- DMARC at p=none: with aggregate reports going to a mailbox or reporting tool.
- Review: after a couple of weeks of reports we fix any legitimate senders that fail.
- Enforce: move to p=quarantine, then p=reject when the reports are clean.
We make the DNS changes at your registrar or host. If your DNS is a mess of old records, our domain and DNS support page explains how we tidy it.
Mailbox security inside Microsoft 365
Authentication records protect your domain. Your mailboxes need protecting too:
- MFA enforced on every mailbox, including shared mailboxes that someone can sign in to directly.
- Legacy authentication (POP, IMAP and basic SMTP AUTH) disabled where nothing needs it.
- Automatic forwarding to external addresses blocked by an outbound spam policy.
- Alerts for suspicious inbox rules and unusual sign-in locations.
- Anti-phishing impersonation protection for directors and finance staff.
If a mailbox has already been compromised, see phishing protection for our clean-up process.
Website forms, newsletters and other senders
The services people forget are the ones that break when DMARC is enforced. A WordPress contact form using PHP mail() sends from your web server, which is not in your SPF record and has no DKIM key, so its messages fail. We switch forms to authenticated SMTP through Microsoft 365 or a transactional service such as Postmark or Brevo, with DKIM set up for your domain. Newsletter tools like Mailchimp need their own DKIM records and ideally a custom return-path. Accounting packages that email invoices "from" you need the same treatment. Once every sender is signed and aligned, enforcement is safe. If your contact form has already stopped sending, see website forms not working.
Pricing
Setting up SPF, DKIM and DMARC for a typical small business with a handful of sending services takes a few hours, charged at £45 an hour + VAT. Moving DMARC to enforcement needs a follow-up review a few weeks later, which is usually short. If you would rather we keep an eye on DMARC reports and mailbox security every month, the Complete plan at £99 a month + VAT includes 3 hours of work and Microsoft 365 helpdesk support.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
What is DMARC and do I need it?
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks. Every business domain should have one. Without it, criminals can easily send fake emails as you. dijitul sets it up in stages so real mail keeps flowing.
Why are my emails going to junk?
The most common reasons are missing or broken SPF, DKIM not enabled, no DMARC record, or a third-party tool sending as your domain without authorisation. dijitul checks message headers and your DNS, fixes the records and confirms that Gmail and Outlook show SPF, DKIM and DMARC passing.
What does 'SPF too many DNS lookups' mean?
SPF allows a maximum of 10 DNS lookups. Each include, such as Microsoft 365, Mailchimp or a CRM, uses one or more. Over 10, SPF returns a permanent error and effectively fails. dijitul removes unused includes and, if needed, flattens the record so it stays within the limit.
Can someone send emails pretending to be my business?
Yes, if your domain has no DMARC policy or it is set to p=none. Receiving servers will usually deliver the fake mail. Once dijitul has your legitimate senders passing SPF and DKIM, we move DMARC to quarantine or reject so spoofed messages are blocked or sent to junk.
How much does email security setup cost?
dijitul charges £45 an hour + VAT. Most small businesses need a few hours for SPF, DKIM and DMARC plus a short follow-up to move to enforcement. Ongoing monitoring and mailbox security are covered by the Complete plan at £99 a month + VAT.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.