SPF, DKIM, and DMARC So Your Site Email Is Not Spam

A contact form can be “working” and still be useless. The message leaves the server and sits in the client’s spam folder, or the client’s own replies from [email protected] never arrive. SPF, DKIM, and DMARC are the DNS records that tell other mail servers the message is allowed to come from that domain.

What each record does

• SPF lists which servers may send mail for the domain. A typical record is a TXT on the root: v=spf1 include:_spf.example.net -all.
• DKIM signs the message with a key published in DNS. The sender (Google Workspace, Zoho, a transactional service) gives you a hostname and a long TXT value.
• DMARC tells receivers what to do when SPF or DKIM fail, and where to send reports. Start with p=none so you can see failures before you reject mail.

You can have only one SPF record. Two TXT records that both start with v=spf1 are a broken setup. Merge the includes into one line.

The usual client setup

1. Decide who sends mail: the same host as the website, or a separate mailbox provider. Prefer a mailbox provider for human mail.
2. Add the provider’s SPF include and DKIM CNAMEs or TXT records exactly as documented.
3. If the website sends form mail through SMTP on that same provider, you do not need a second system. If the form uses a different SMTP service, add that service’s include to the same SPF record.
4. Publish a DMARC TXT on _dmarc.example.com.

Do this before the website goes live if the domain is new. A brand-new domain with no history already looks suspicious. Missing authentication makes it worse.

What I test

Send from the form and from the human mailbox to a Gmail address you control. Check the original message for spf=pass and dkim=pass. Alignment means the domain in the From header matches the domain that authenticated.

Also send to the client’s own address. Some company filters are stricter than Gmail.

Mistakes that recreate the spam folder

• Changing nameservers to a CDN and forgetting to copy MX, SPF, and DKIM.
• Letting the web host send form mail as @gmail.com. Receivers reject or spam that immediately.
• Adding -all on SPF before every real sender is included. You will block the client’s own invoices.

Keep a note in the project of which provider owns mail. The next DNS edit should start from that note, not from a blank zone file.