How to Set Up SPF, DKIM and DMARC: Get Your Form and Business Emails Delivered

If your business emails or the lead notifications from your website land in spam, the cause almost always lies with missing or incorrect email authentication. SPF, DKIM and DMARC are three small DNS records that prove to receiving mail servers, such as those of Gmail and Outlook, that an email really comes from your domain and not from someone impersonating you. If they are absent or wrong, your emails are treated with suspicion. In this article we explain what each record does, why they are crucial for your lead flow, and how to set them up without needing to be a mail expert.

Why do my business emails and lead notifications end up in spam?

The short version: because the receiving server cannot verify that the email really comes from you. Mail servers now trust nothing by default. Every incoming email is weighed against countless signals, and authentication is one of the heaviest of them. An email from a domain without SPF, DKIM and DMARC looks, to a recipient, like a letter with no sender and no stamp: maybe genuine, maybe not, so to be safe, into the spam folder it goes.

The painful part is that this often happens unnoticed with the emails that pay off the most: the notifications your website sends. Email deliverability is therefore part of the technical foundation of a B2B website that generates leads, alongside speed, structure and findability. Specifically, this concerns the alert you receive when someone fills in a contact or quote form. Many sites send that on behalf of your own domain, but through a mail server your domain has never recognised as a valid sender. The result: a prospect neatly fills in your form, but the notification lands in spam or never arrives, and you do not even know you missed that lead. A form that works technically perfectly but whose alert never arrives is still a leak in your form optimisation.

What exactly does an SPF record do?

SPF (Sender Policy Framework) is a DNS record that lists which servers are allowed to send mail on behalf of your domain. It is essentially a guest list at the door. When an email arrives, the receiving server checks which server sent it and verifies whether that server is on your SPF list. If it is, the SPF check passes. If it is not, that is a strong signal the email is forged.

In practice, an SPF record is a TXT record in your DNS that looks like v=spf1 include:_spf.google.com ~all. Every party that sends mail on your behalf, your mail provider, your newsletter software, the system behind your website forms, must be included in it. That is also the most common mistake: companies add their mail provider but forget the tool that sends their form notifications or invoices. Those emails then quietly fail the check.

Important to know: SPF looks at the technical sender address, not at what the recipient sees. That is why SPF alone is not enough, and that is why DKIM and DMARC exist.

What does DKIM do and why do you need it alongside SPF?

DKIM (DomainKeys Identified Mail) places a digital signature on every email you send, so the recipient can verify that the content was not changed in transit and really comes from your domain. Where SPF checks the sending server, DKIM proves the authenticity of the email itself.

It works with a key pair. Your mail server signs outgoing mail with a secret key. The corresponding public key you publish as a DNS record. The recipient retrieves that public key, checks the signature, and thereby knows whether the email is authentic and unaltered. You do not need to understand the cryptography to use it: in most mail platforms you generate the key with a few clicks and paste the supplied value into your DNS.

SPF and DKIM together cover two different risks, and that is why you want both. An email that passes through a mailing list or forwarding service can break SPF but keep DKIM, or the other way around. With both records in place, there is almost always at least one valid proof left that the email really is from you.

What does DMARC do and what do p=none, quarantine or reject mean?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the keystone: it tells receiving servers what to do when SPF or DKIM fails, and it sends you reports about who is sending mail on behalf of your domain. Without DMARC, SPF and DKIM are separate checks without a clear instruction on what should happen in case of doubt.

You publish a DMARC record as a TXT record at _dmarc.yourdomain.be. The most important part is your policy, the p= part, which has three settings:

• p=none: monitoring. Nothing happens to failing mail, but you do receive reports. This is the safe starting setting to see everything that is sent on behalf of your domain.
• p=quarantine: failing mail goes to the spam folder.
• p=reject: failing mail is refused entirely. This is the strictest setting and the best against abuse of your domain name, but you only switch it on once you are certain that all your legitimate senders are correctly authenticated.

DMARC also adds the concept of alignment: the domain the recipient sees in the From address must match the domain covered by SPF or DKIM. That is precisely what abusers cannot forge, and it is the reason DMARC offers protection that SPF and DKIM alone do not give.

The recommended approach is phased: start on p=none, read the reports for a few weeks, fix every sender that still fails, and only then move on to quarantine and eventually reject. Jumping to reject too quickly can block legitimate mail.

Is this mandatory or nice-to-have?

For those who send a lot of mail, it is now a hard requirement. Since early 2024, Gmail and Yahoo have required senders who send large volumes to their users, in the order of thousands of emails per day, to have SPF and DKIM correct, a DMARC record present with at least p=none, and a working unsubscribe link in marketing emails. Gmail began enforcing these rules more strictly over the course of 2025, refusing non-compliant mail more often instead of merely marking it as spam.

If you do not send large newsletters, you strictly speaking do not fall under that threshold. But the underlying logic applies to everyone: the same spam filters that judge bulk senders also judge your quote email and your form notification. Good authentication is therefore not a separate rule for big players, but the basic hygiene that determines whether your everyday business mail arrives at all. For a B2B company that depends on leads through the website, that is no detail.

How do you set up SPF, DKIM and DMARC?

Broadly speaking, you go through four steps, all in the DNS management of your domain:

1. Inventory your senders. Make a list of everything that sends mail on behalf of your domain: your mail provider, your newsletter tool, your invoicing software and the system behind your contact forms. This is the step most people skip and the one that causes the most problems.
2. Set up SPF. One TXT record that lists all those senders via include rules. Note: you may only have one SPF record per domain, so everything is combined into that single record.
3. Set up DKIM. Activate DKIM in every mail platform you use and publish the corresponding public keys as DNS records. Each platform supplies that value ready to use.
4. Set up DMARC. Publish a DMARC record at _dmarc.yourdomain.be, start on p=none with a reporting address, and build up the policy step by step.

After that, you check the result. Send a test email to a Gmail address and view the message details, or use a free online checking tool to see whether all three checks pass. Changes in DNS can take up to a few hours before they are visible everywhere, so do not expect everything to turn green right away.

The short summary

SPF, DKIM and DMARC together are the proof that an email really comes from your domain. SPF checks the sending server, DKIM signs the email itself, and DMARC determines what happens in case of doubt and reports who is mailing on your behalf. Without that trio, your business emails are treated with suspicion and it is above all your form and lead notifications that leak away into spam, precisely the emails that pay off the most. Start by mapping your senders, set up the three records, and calmly build up your DMARC policy from monitoring to enforcement.

We do not view email deliverability as a standalone IT job, but as part of a website that reliably brings in leads: a form is only finished when the alert actually lands in your inbox. Want to be sure no lead is lost between your site and your mailbox? Schedule your free intake.