DNS and Business Email: SPF, DKIM, DMARC and Deliverability Basics
Business email relies on DNS records to tell the internet where mail should be delivered and which systems are authorized to send it. A mailbox can exist and still fail to send or receive correctly if DNS is incomplete or conflicting.
Email Depends on DNS
Business email relies on DNS records to tell the internet where mail should be delivered and which systems are authorized to send it. A mailbox can exist and still fail to send or receive correctly if DNS is incomplete or conflicting.
MX Records
MX records identify the mail servers that receive messages for a domain. Priorities matter when multiple servers are listed. Old MX records left behind after a provider migration can cause unpredictable delivery behavior.
SPF
SPF is a DNS-based policy that identifies servers authorized to send mail for a domain. A domain should normally have one effective SPF record. Multiple separate SPF TXT records can cause validation problems; authorized services are generally combined into one policy.
DKIM
DKIM adds a cryptographic signature to outgoing messages. The receiving system retrieves the public key from DNS and verifies that the signed content has not been altered. DKIM setup normally involves both the email provider and DNS.
DMARC
DMARC builds on SPF and DKIM and tells receiving systems how to handle messages that fail alignment checks. It can also provide reports. Policies should be introduced carefully so legitimate third-party senders are identified before enforcement is tightened.
Third-Party Senders
CRMs, newsletters, support systems, website forms, transactional-email platforms and invoicing tools may all send mail using your domain. Each legitimate sender needs to be considered when configuring authentication.
Website Form Email
A website form should not simply pretend to send from a visitor's external email address through your domain. Using authenticated SMTP or a transactional email provider and setting reply-to appropriately usually produces a cleaner, more reliable setup.
Troubleshooting Deliverability
Check DNS records, provider logs, message headers, authentication results, blocklists where relevant, sending reputation and whether messages are being rejected or merely routed to spam. Deliverability is a system of signals, not a single DNS switch.
