If your emails are landing in customers' junk folders, or bouncing back with a message about authentication, someone has probably mentioned SPF, DKIM and DMARC. Here is what they actually are, without the jargon.

All three are small settings published in your domain's DNS — the public directory that tells the internet where your website and email live. Together they prove that mail claiming to come from your business really did come from your business.

The three, one sentence each

SPF

SPF is a public list of which mail servers are allowed to send email using your domain. When a message arrives claiming to be from you, the receiving server checks your list. If the sending server is not on it, that is a mark against the message.

DKIM

DKIM adds an invisible signature to every message you send, so the receiver can prove it was not tampered with in transit and really came from your domain. Think of it as a wax seal: if the seal is intact, the letter is genuine and unopened.

DMARC

DMARC tells receiving servers what to do when SPF and DKIM fail, and where to send reports about it. You can ask them to deliver anyway, put it in junk, or reject it outright. The reports show you who is sending mail using your name — including anyone pretending to be you.

SPF and DKIM are the evidence. DMARC is the instruction about what to do with the evidence, plus the paperwork.

Why this matters now

It used to be that badly authenticated mail merely looked a bit suspicious. That has changed. The large mail providers now check these records on incoming mail and will send it to junk or refuse it entirely if the checks fail, particularly for anyone sending in volume. Australian businesses feel this most when their invoices, quotes and newsletters quietly stop arriving.

The other reason is fraud. Without these records, anyone can send email that appears to come from your address. The common version is a scammer emailing your customer, apparently from your accounts address, with a changed bank account number on an invoice. Proper authentication does not make that impossible, but it makes it far harder and gives receiving servers grounds to block it.

Common signs your records need attention

• Your email lands in junk for some recipients but not others, especially at large providers.
• Bounce messages mentioning SPF, DKIM, DMARC, "unauthenticated", or "message not accepted for policy reasons".
• A new system — accounting software, a booking system, a mailing platform, a CRM — was set up to send email as your business and its mail is not arriving.
• Customers report receiving strange emails from your address that you did not send.
• You changed email provider recently and some mail has become unreliable.

Why this is not a do-it-yourself job

These records look harmless. They are short lines of text, and the internet is full of examples you can copy. That is exactly the trap.

A mistake in an SPF record does not produce a helpful error. It stops mail. Publish an SPF record that omits one of the systems that legitimately sends on your behalf — your accounting package, your booking system, your marketing platform — and that mail starts failing, often without a bounce you will see. Set DMARC to reject before SPF and DKIM are correct for every sending system, and you can take your entire outgoing mail offline in one save. Add a second SPF record when one already exists, and you can break both.

The failures are also delayed and inconsistent. Some recipients keep receiving your mail while others do not, so it can take days to notice, and by then you have no idea which change caused it.

The safe way is to inventory everything that sends mail as your business first, publish SPF and DKIM correctly for all of it, start DMARC in report-only mode so you can see what is happening without blocking anything, read the reports, and only then tighten the policy. It is not difficult work, but the order matters and the testing matters.

What to do

1. Do not edit DNS records yourself, and do not paste in a record a software vendor's help page suggested without checking it against what you already have.
2. Collect the evidence. Save a bounce message in full if you have one — the technical detail at the bottom is the useful part — and note which recipients are affected.
3. List everything that sends email as your business. Your main mail platform, plus accounting, quoting, booking, e-commerce, marketing, and anything a staff member signed up for. This list is the single most useful thing you can give us.
4. Log a ticket and we will review what is published now, tell you plainly what is wrong, and fix it in the right order.

Still stuck?

Log a ticket at portal.yougrowit.com.au or email support@yougrowit.com.au. If it is stopping you working right now, call 03 9028 4358.

Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.