Email Deliverability Basics (SPF/DKIM/DMARC Without Jargon)

Last updated

May 13, 2026

Reviewed by

IT Service Delivery Lead

Speakable Summary

SPF, DKIM, and DMARC help other mail systems trust your email. Book a Fit Check to reduce spam-folder problems without breaking vendor mail flow.

Opening

When email deliverability breaks, it feels random. One day invoices land fine and the next day they land in spam or never arrive.

Most deliverability issues come down to trust signals. Receiving mail systems want proof that a message claiming to be from your domain is actually allowed and actually authentic.

This page explains SPF, DKIM, and DMARC in plain English. It also explains what breaks most often and what to document so fixes stick.

Direct Answer

SPF, DKIM, and DMARC are domain trust checks used by email systems. They reduce spam-folder issues by proving your domain is allowed to send and your messages are authentic.

‍

What’s included vs what’s usually extra

‍

●    List every service that sends email for your domain

●    Fix SPF and DKIM first before tightening DMARC

●    Make changes with change control to avoid breaking vendors

Included means baseline checks and corrections. Extra means large mail architecture work and complex multi-domain programs.

‍

Deliverability across people, devices, apps, and operations

If you only do one thing this week

●    Make a list of every system that sends email for your domain.

●    Confirm SPF and DKIM are enabled for your primary mail system.

●    Start DMARC in monitor mode and review reports.

People

Deliverability problems create real business pain. Quotes get missed, invoices do not arrive, and staff waste time resending.

Simple rules reduce stress. A clear sending listand a documented change process prevents repeated breakage.

Device

Devices are usually not the cause of deliverability problems. The cause is usually domain settings and how email is authenticated.

Still, device and app behavior matters for testing. Always test from multiple inboxes and confirm results.

Account/App

Deliverability depends on your domain and the services that send as your domain. Microsoft 365, payroll tools, CRMs, and marketing systems all need to be accounted for.

If one service is forgotten, authentication will fail and messages will be treated as suspicious. That is why the sending list matters most.

Operations

Deliverability is not a one-time setup. Vendors change, new tools get added, and domain records drift.

Documenting sending sources and reviewing changes prevents long troubleshooting cycles. Use change control for DNS changes.

‍

Deliverability in plain English

Email systems try to stop spam and impersonation. They do that by checking whether your domain is allowed to send and whether the message looks authentic.

SPF, DKIM, and DMARC are the main trust checks. They work together, and they fail most often when a business adds new sending tools without updating records.

‍

SPF, DKIM, and DMARC without jargon

SPF explained

SPF is a list of who is allowed to send email for your domain. It lives in your domain DNS and tells receivers which mail servers or services are permitted.

If SPF fails, a receiving system may treat the message as suspicious. SPF fails most often when you forget to include a vendor service that sends on your behalf.

DKIM explained

DKIM is a digital signature added to outgoing email. It proves the message was not altered and that it truly came from a sender authorized for your domain.

If DKIM fails or is missing, messages can still deliver but trust is lower. DKIM often breaks when it is not enabled for a sending service or when keys are rotated incorrectly.

DMARC explained

DMARC is the policy that tells receiving systems what to do when SPF and DKIM checks do not line up. It also gives you reports so you can see who is sending mail using your domain.

Start DMARC in monitor mode so you can see what is happening without breaking mail. Tighten the policy only after you confirm all legitimate senders are accounted for.

‍

What breaks most often

A new vendor starts sending email and nobody updates records

Marketing tools, CRMs, payroll systems, and ticketing systems often send email. If they are not on the sending list, authentication fails and deliverability drops.

The fix is simple but requires discipline. Maintain a sending inventory and update DNS using change control.

SPF becomes too long or too messy

SPF has limits and complexity can cause problems. Long SPF chains and too many “includes” can create failure even when you think it is correct.

The practical fix is to reduce unnecessary senders and use a clean sending model. Keep SPF readable and documented.

DKIM is enabled for the primary system but not for secondary senders

Many businesses enable DKIM for Microsoft 365 but forget about other services. That creates inconsistent trust and inconsistent delivery.

The fix is to enable DKIM for every service that sends as your domain. Document which ones are active.

DMARC is set to enforce before you are ready

If you jump to strict enforcement too early, real vendor mail can start failing. This often shows up as missing invoices and vendor complaints.

Start with monitor mode and tighten slowly. This avoids business disruption.

Different “From” addresses are used without planning

Some vendors send using your domain while others send using their own. Mixing approaches without understanding can confuse reporting and trust.

The fix is to decide your standard. Either send as your domain with proper authentication or send as the vendor domain and align branding and reply-to.

‍

Common Questions

Do I need SPF, DKIM, and DMARC as a small business?

Yes because they improve trust and reduce spam-folder delivery. They also reduce impersonation risk.

Do I need DMARC if SPF and DKIM are already set?

Yes because DMARC ties the rules together and gives visibility. Start in monitor mode first.

Do I need to change anything if our email “mostly works”?

If important mail lands in spam, you should review basics. Most fixes come from cleaning up sending sources.

What’s the difference between SPF and DKIM?

SPF checks whether a sender is allowed. DKIM checks whether the message has a valid signature.

What’s the difference between DMARC and SPF or DKIM?

DMARC sets the policy and provides reporting. It tells receivers what to do when checks do not align.

What happens if we add a new marketing tool?

Deliverability can drop if DNS is not updated. Add the tool to your sending inventory and update records with change control.

What happens if a vendor’s emails are going to spam?

Check whether they send as your domain and whether authentication aligns. Fix either the vendor settings or your domain records.

What happens if we set DMARC too strict?

Real mail may be rejected or quarantined. Start in monitor mode and tighten after reports confirm legitimate senders.

What happens if SPF has too many includes?

SPF checks can fail even with correct intent. Simplify by reducing senders and cleaning the record.

What happens if DKIM keys break?

Trust drops and deliverability can suffer. Re-enable DKIM and verify the signing domain is correct.

Can deliverability fixes reduce phishing and impersonation?

Yes because DMARC can reduce spoofing. It does not stop all phishing but it reduces direct domain impersonation.

Can deliverability changes cause downtime?

Yes if applied without testing and inventory. Use change control and phased rollout.

Can we do this without changing email providers?

Usually yes because these are domain settings. Provider changes are not required for basic fixes.

Can this be part of managed IT scope?

Often yes at a baseline level. Large redesigns and multi-domain programs are usually projects.

‍

Key terms in plain English

Deliverability: Whether your email lands in the inbox.
Domain: Your email name space like yourcompany.com.
DNS record: A domain setting that controls services like email.
SPF: A rule listing who is allowed to send for your domain.
DKIM: A signature that proves messages are authentic.
DMARC: A policy and reporting system for email authentication.
Sending source: Any system that sends email for your domain.
Change control: Approving and documenting DNS changes before applying them.

‍

Choosing actions for common deliverability problems

‍

Comparing authentication checks and DMARC modes

SPF vs DKIM

SPF proves the sender is allowed. DKIM proves the message is signed and authentic.

Monitor mode vs enforce mode for DMARC

Monitor mode shows you what is happening without breaking mail. Enforce mode blocks or quarantines mail that fails alignment.

‍

Copy/paste email authentication and sending inventory checklist

• List every service that sends email for your domain
• Confirm SPF includes all legitimate senders
• Confirm DKIM is enabled for each sender
• Start DMARC in monitor mode
• Review DMARC reports for unknown senders
• Remove unused senders and simplify SPF
• Tighten DMARC only after alignment is clean
• Use change control for all DNS edits
• Document the final sending inventory and owners

‍

Common mistakes

• Forgetting a sending vendor and fix it by maintaining a sending inventory.
• Setting DMARC to enforce too early and fix it by starting in monitor mode.
• Allowing SPF to grow endlessly and fix it by reducing senders and simplifying.
• Enabling DKIM only for the primary system and fix it by enabling it for all senders.
• Making DNS changes without change control and fix it by approving and documenting edits.
• Treating deliverability as one-time work and fix it by reviewing changes when tools change.

‍

Common objections

We are too small to worry about this. Small businesses still rely on invoices and scheduling email. Deliverability issues cost real time and money.

We do not send marketing emails. Transactional emails still matter. Payroll, vendors, and customers all depend on trust.

This sounds technical. The rules are simple when written plainly. Inventory plus phased changes prevents breakage.

We are afraid of breaking email. Start with monitoring and small changes. Use change control and testing.

Our vendor should handle it. Vendors control their setup but your domain records are your responsibility. Coordination is required for good results.

‍

What affects your email deliverability setup

• It depends on how many tools send mail for your domain.
• It depends on whether vendors send as your domain or their own.
• It depends on how complex your SPF record has become.
• It depends on whether DKIM is enabled consistently.
• It depends on how strict DMARC is and whether you are ready.
• It depends on how often your toolset changes.

‍

How we manage senders and email authentication

We start by building a complete sending inventory in plain English. Then we verify SPF and DKIM for each sender and start DMARC in monitor mode to avoid disruption.

Changes are made with change control and tested against real inboxes. We document sending sources so future vendor additions do not break deliverability.

‍

How we measure deliverability and authentication results

• Spam-folder rate for critical outbound mail
• Number of legitimate senders documented and verified
• DMARC report findings and unknown sender count
• SPF record complexity and changes over time
• Spoofing attempts reduced by DMARC enforcement

‍

FAQs

What do SPF, DKIM, and DMARC do in simple terms?

They help other mail systems trust your email. They prove you are allowed to send and that your messages are authentic.

Which one should we fix first?

Start with SPF and DKIM. Then add DMARC in monitor mode.

Will this stop all spam and phishing?

No but it reduces impersonation and improves trust. It is a baseline control not a full security plan.

Can these settings break vendor email?

Yes if you enforce DMARC too early or forget a sender. Start in monitor mode and keep a sending inventory.

How do we know which vendors send email for our domain?

List every tool that sends invoices, newsletters, or notifications. DMARC reports can also reveal unknown senders.

What is DMARC monitor mode?

It is a reporting-only mode. It lets you see failures without blocking mail.

How often should we review deliverability?

Review when you add or change tools. Review monthly if you have many senders.

Do we need to change email providers to fix deliverability?

Usually no. These are domain trust settings and can be fixed without migrating platforms.

What is the most common cause of deliverability problems?

A forgotten sending service is the most common cause. Inventory and documentation prevent it.

What is a Fit Check?

A Fit Check inventories your senders and checks authentication basics. It produces a plain-English plan to improve deliverability.

‍

Call to action

If invoices or customer emails are landing in spam, book a Fit Check. You will get a sending inventory, a baseline SPF DKIM DMARC check, and next steps you can act on.

‍

‍