Table of contents
Why your emails end up in spam
You sent an important quote and the client tells you they never received it. You find it in spam, or it never arrived at all. It is not bad luck: mail systems — Gmail, Outlook, all of them — have become extremely strict about filtering, and to do so they check whether the sender is really authorised. If your domain has not configured the three protocols that prove this, your emails start at a disadvantage. The paradox is that the problem often lies not in the content of the email, but in three lines of configuration nobody has ever set up properly.
| Protocol | What it is for | How it works | If it is missing |
|---|---|---|---|
| SPF | States which servers may send on your behalf | A public list of authorised servers: if the sender is not on it, the mail is suspect | Anyone can impersonate you — and it happens more often than you think |
| DKIM | Proves the mail really comes from you and has not been altered | A cryptographic signature on every outgoing mail, verifiable by the recipient | No proof of integrity: the mail can be modified along the way |
| DMARC | Tells the recipient what to do when SPF or DKIM fail | A policy: ignore, quarantine or reject. And it sends you the reports | No rule and no visibility on who is using your domain |
SPF: who can write in your name
SPF is a public list stating which servers are authorised to send email with your domain. When an email arrives from info@yourcompany.com, the recipient checks that list: if the server that sent it is not there, the email becomes suspect. It serves to block anyone impersonating you — and it happens more often than you might think, because forging the sender of an email is trivially easy. The configuration is a single line in the domain DNS, but it must be updated every time you add a service that sends mail on your behalf: the ERP, the newsletter, the website form.
Are your emails ending up in spam?
We check your domain configuration and fix what is missing.
Let’s talk about your caseDKIM: the signature nobody can forge
DKIM adds a cryptographic signature to every outgoing email. The recipient verifies it and knows two things: that the email really comes from your domain, and that nobody altered it along the way. It is much stronger proof than SPF, because it does not depend on the sending server but on a key only you possess. Activating it is usually straightforward — the main mail providers generate it with a click — but it must then be published correctly in the DNS. If you skip this step, you have half the protection and the spam filters notice.
DMARC: the rule that ties it all together
DMARC is the policy telling the recipient what to do when SPF or DKIM fail: ignore, quarantine, or reject. And it is also the protocol that sends you reports on who is using your domain. Caution is needed here: switching straight to the strictest rule (reject) without having checked that all your legitimate services are properly configured means blocking your own emails. The correct path is gradual: you start in observation mode, read the reports, fix what is not aligned, and only at the end tighten the rule. A domain can have only one DMARC policy: if one already exists, it must be modified, not added.
What to do, in order
First: check what you already have, because often something is there but incomplete. Second: line up all the services that send mail on your behalf — business mail, website, newsletter, ERP, invoicing — because each must be authorised. Third: configure SPF and DKIM for all of them, one at a time. Fourth: enable DMARC in observation mode and read the reports for a few weeks. Only when the reports are clean, raise the strictness. It is a few hours of work that saves months of quotes vanishing into thin air, and drastically reduces the risk of someone impersonating your company. If you need it, we handle it as part of maintenance.