Email Deliverability in Plain English: SPF, DKIM and DMARC

You set up email on your domain, sent a perfectly reasonable invoice, and it vanished into someone's spam folder. This is almost always a deliverability problem — and it's fixable with three records and a bit of knowledge. Here's the plain-English version of SPF, DKIM and DMARC: what they do, why 2026 inboxes demand them, and what to ask your host.

Your email has three identity documents

Receiving servers (Gmail, Outlook, everyone) can't see your face. They check paperwork:

• SPF (a DNS record): "These servers are allowed to send email as mydomain.com.au." If a stranger's server starts sending as you, SPF exposes it.
• DKIM (a cryptographic signature): Each outgoing email is signed with a private key; the public key in your DNS lets receivers verify the message wasn't tampered with en route. It's a wax seal that can't be forged.
• DMARC (the policy): Tells receivers what to do when SPF or DKIM fail — accept, quarantine, or reject — and reports back to you who's been sending as your domain. This is how you find out someone's impersonating you.

Why this suddenly matters more

The big inbox providers have spent the last few years tightening the screws: bulk senders need authentication, and even ordinary small-business mail gets scored on it. Missing or broken records don't just risk spam folders anymore — they can get your domain quietly reputation-damaged for everything else it sends. If your email "mostly works", that's not the same as healthy.

Check yours in ten minutes

1. Send a test email to a Gmail address and use "Show original" — it spells out SPF, DKIM and DMARC pass/fail in plain text.
2. Look up your DNS records (any MX lookup tool): is there an SPF record? A _dmarc record? DKIM keys?
3. Fix what's missing — your email provider will have copy-paste records, and your host should help if email lives with them.
4. Watch the DMARC reports for a few weeks before strictening the policy. Start at "none" (monitor), graduate to "quarantine".

One more thing: where your email lives

Self-signed certificates and mystery relay servers cause half the deliverability drama we see. Modern mail platforms — we run Stalwart® with Bulwark filtering — handle SPF, DKIM and DMARC as standard, with the shiny extras (junk filtering that actually learns, proper quarantine, sensible limits) built in rather than bolted on. Every DomainCastle plan includes it. Ask us about moving your email across — it's less painful than you think, and it comes with the same honest support as everything else we run.