SPF, DKIM and DMARC: why business emails end up in spam

Picture the scene. One morning the owner of a company with several offices gets a call from a long-standing customer: “I paid your invoice to the new IBAN, but the bank says the account isn’t yours.” The email looked perfect. Logo, signature, correct invoice number. And the sender was their own address, not a look-alike.

In the projects we follow this is often how it goes: the issue comes up when someone has already lost money. Or when the sales team realises their quotes have been landing in customers’ spam folders for weeks.

In both cases the cause is almost always the same: three DNS records that are missing, wrong or only half set up. Let’s look at what they are, without the jargon.

Why emails get spoofed (and why it works)

Email was born without any check on the sender. Typing “accounts@yourcompany.com” in the From field is as easy as writing a fake return address on the back of an envelope.

Fake supplier and fake IBAN scams, which insiders call BEC (Business Email Compromise), partly rely on this. According to the FBI, in 2025 BEC scams caused over 3 billion dollars in reported losses in the United States, across 24,768 complaints (IC3, Internet Crime Report 2025).

The picture in Italy is no calmer. The Clusit 2026 Report states that Italy suffered 9.6% of the serious incidents recorded worldwide in 2025, and that phishing and social engineering were behind 12.4% of Italian cases, up 66% (Clusit 2026 Report summary).

The three records explained as a front desk

Picture the front desk at your offices.

• SPF is the list of authorised couriers allowed to collect and send mail on your behalf. It says which servers can send email with your domain: your email provider, your newsletter platform, your CRM.
• DKIM is the signed stamp on the envelope. Every email leaves with a digital signature that the recipient checks against a key published in your DNS. If someone alters the message, the signature no longer matches.
• DMARC is the set of instructions left with the receptionist: what to do with anyone who turns up in your name without being on the list or without the stamp. Let them through (p=none), send them to the waiting room, that is, to spam (p=quarantine), or turn them away (p=reject). On top of that, the receptionist sends you a report of who showed up.

SPF and DKIM alone are not enough: without DMARC the recipient does not know what you want them to do.

What Google, Yahoo and Microsoft now require

Since 1 February 2024 Gmail has required at least SPF or DKIM from every sender. From those sending more than 5,000 messages a day it requires SPF and DKIM together, a DMARC record (even just p=none), alignment between the sender’s domain and the authentication, one-click unsubscribe and a spam complaint rate below 0.3% (Google, email sender guidelines). Yahoo introduced similar requirements in the same month (Yahoo Sender Hub).

Since 5 May 2025 Microsoft has applied similar rules on Outlook.com, Hotmail and Live to senders above 5,000 emails: non-compliant messages are rejected with error 550 5.7.515 (Microsoft Support).

A newsletter to a few thousand contacts, added to automatic invoices and reminders, quickly approaches the 5,000-email threshold, above which all three records are needed. But SPF or DKIM are required from everyone, whatever the volume. Even if you send 10 emails a day, without SPF or DKIM they risk ending up in the recipient’s spam.

How to check your domain in 5 minutes

1. Send an email to a Gmail address and open it: three-dot menu, “Show original”. At the top you will see SPF, DKIM and DMARC with their result, PASS or FAIL.
2. Enter your domain in a free tool such as MXToolbox, Google Admin Toolbox or Internet.nl. They tell you whether the records exist and whether they contain obvious errors.
3. Look at the DMARC line. If it is missing, or has been set to p=none for years, your address can be spoofed.

Repeat the test with an email sent from your newsletter, your CRM and your invoicing software. That is usually where the surprise turns up.

The mistakes we see most often

• Two SPF records on the same domain. Only one is allowed: with two, the check fails.
• Too many services in the SPF record. The standard allows a maximum of 10 DNS lookups for the check (RFC 7208). Each service you add uses one or more, and beyond the limit SPF returns an error.
• DMARC stuck at p=none for years. It is for observing, it does not protect. Of 1.8 million domains analysed in early 2026, 52.1% had a valid DMARC record but only 22.9% actually enforced it with quarantine or reject (EasyDMARC, 2026).
• Forgotten third-party services. Newsletter, CRM, invoicing software, multifunction printers that email scans: each one sends on your behalf and has to be authorised.
• Domain not aligned. SPF and DKIM pass, but they are tied to the newsletter provider’s domain instead of yours. Without alignment with your domain, DMARC fails.
• Nobody reads the reports. They arrive in XML and sit in an inbox nobody opens.

The gradual path: from p=none to reject

Switching straight to reject is the quickest way to block your own invoices. This is the path we follow:

1. Snapshot, 2-4 weeks. DMARC at p=none with an address for the reports. You find out who is really sending on behalf of the domain.
2. Clean-up. Every legitimate service is authorised in SPF and, where possible, signed with DKIM. Services no longer in use are removed.
3. Quarantine. p=quarantine, checking the reports every week and fixing whatever comes up.
4. Reject. When the reports are clean, p=reject. From here on, anyone spoofing your exact domain is turned away.
5. Maintenance. Every new tool that sends email is checked before it goes into use.

It usually takes two to four months, depending on how many services send on your behalf.

An honest caveat: DMARC protects your exact domain, not look-alike ones (such as yourcompany-com.net), nor a mailbox breached with a stolen password. That is why you also need a simple internal rule: every IBAN change is confirmed by phone, on a number you already know, never the one written in the email.

Why we think “it won’t happen to us”

In 1980 the psychologist Neil Weinstein described optimism bias: we tend to rate our own risks as lower than other people’s (Weinstein, 1980). In a company it becomes “we’re small, who would bother targeting us”.

But those who spoof emails do not choose by size. They automatically try thousands of domains and stop at the unprotected ones. The risk does not depend on how big you are, but on how easy you are.

How we work

We start by checking the domain and listing the services that send on your behalf. Then we set up the records step by step, read the reports with you and get to p=reject without stopping the emails you need. If you would like to start with a check, there is our free check-up.

Frequently asked questions

Do we really need all three records?

Yes. SPF and DKIM say who you are, DMARC says what to do with anyone pretending to be you. One without the others leaves the domain exposed.

If I switch to p=reject, do I risk losing important emails?

Only if you get there without the observation phase. With the reports and a gradual transition the risk is kept to a minimum.

Do they apply even if we send only a few emails?

Yes. Gmail and Yahoo require SPF or DKIM from every sender, even those who send only a few emails; SPF, DKIM and DMARC together are needed by anyone sending more than 5,000 emails a day. And domain spoofing can hit anyone: protection matters regardless of the numbers.

Does DMARC also block domains that imitate mine?

No, it only protects the exact domain. For look-alike domains you need attention, staff training and verification procedures for payments.

Let’s talk

If you want to know what shape your domain is in, book a 30-minute call. Or write to us at posta@swdweb.it.

Leonardo Pantaleo, CEO of SWD Group

---