When a customer says your invoice never arrived, or a vendor finds your quote in their spam folder, the problem is often not the message. It is the way your domain proves that email really comes from you. Three DNS records, called SPF, DKIM, and DMARC, tell Gmail, Outlook, and Yahoo which servers may send for your business and what to do with fakes. Without them, real mail gets filtered and scammers can send invoices that look like they came from your address. Here is what each record does, how to tell if yours are missing, and how small businesses from Mays Landing to Egg Harbor Township, Hammonton, and the rest of Atlantic and Cape May counties can fix them without breaking the email they already depend on.
Signs your business email has an authentication problem
You do not need to read mail headers to suspect trouble. Watch for:
- Invoices, quotes, or appointment reminders landing in spam for customers who use Gmail, Outlook.com, or Yahoo.
- Bounce messages that mention SPF, DKIM, DMARC, or "unauthenticated" mail.
- Customers or vendors receiving emails "from you" that you never sent, often fake invoices or payment change requests.
- A website contact form, booking tool, or invoicing app that sends mail with your address but often goes missing.
- A recent switch of email provider, website host, or newsletter tool, after which delivery got worse.
What SPF, DKIM, and DMARC actually do
Each record answers a different question for the receiving mail server:
- SPF (Sender Policy Framework) lists the services allowed to send mail for your domain, such as Microsoft 365 or Google Workspace, your invoicing software, and your newsletter tool. Mail from anywhere else looks suspicious.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The receiver checks it against a public key in your DNS to confirm the message was not altered and really came through an approved service.
- DMARC ties the two together. It tells receivers what to do when a message fails, whether that is to deliver it anyway, send it to spam, or reject it, and it can send you reports showing who is sending mail with your name on it.
The big mailbox providers have tightened their rules over the last few years. Gmail, Yahoo, and Outlook.com now expect senders to authenticate their mail, and higher-volume senders are expected to have all three records in place. Even a small office that only sends a few dozen emails a day benefits, because authenticated mail is simply trusted more.
Common mistakes we find in small business DNS
Most problems come from email setups that grew one tool at a time:
- No DMARC record at all, so receivers have no instructions and spoofers face no consequences.
- Two SPF records on the same domain, which makes both of them invalid.
- An SPF record that forgets a sender, like the invoicing app, the website form, or the copier that scans to email.
- DKIM never turned on in Microsoft 365 or Google Workspace, even though it is included with the subscription.
- Old services still listed after the business moved on, which widens the door for abuse.
- Jumping straight to a strict DMARC policy before every legitimate sender passes, which quietly blocks real mail.
How to roll it out without losing mail
A careful rollout protects your domain without surprising anyone:
- Inventory every service that sends as your domain. That includes your main mailbox provider, invoicing and payment tools, scheduling and booking apps, your website, newsletters, and any scanner or alarm panel that emails reports.
- Publish one clean SPF record that includes each approved sender and nothing extra.
- Turn on DKIM for your mailbox provider and for each third-party tool that supports it.
- Start DMARC in monitoring mode so you receive reports without blocking anything yet.
- Review the reports for a few weeks, fix any legitimate sender that fails, and then step the policy up to quarantine and eventually reject.
- Write it down. Keep a short list of what is authorized so the next new tool gets added correctly instead of breaking delivery.
Authentication is not the whole email security picture
These records stop people from faking your exact domain, but they do not stop every scam. Pair them with:
- Multi-factor authentication on every mailbox, so a stolen password cannot open your account.
- A habit of calling to confirm any request to change bank details or pay a new invoice, using a phone number you already have on file.
- Look-alike domain awareness. Scammers register names one letter off from yours, and only training and a second look catch those.
Talk to a local IT team about your email
Izzo Network helps South Jersey offices, shops, practices, and restaurants clean up email DNS, set up SPF, DKIM, and DMARC, and keep Microsoft 365 and Google Workspace secure, from Mays Landing, NJ 08330 across Atlantic and Cape May counties. Call or text (609) 415-0011, or use the contact form, to have your domain checked before the next invoice goes missing.
FAQ
How do I know if my domain already has SPF, DKIM, and DMARC?
Free online lookup tools can check your domain's DNS in seconds. If any of the three are missing, or you see two SPF records, it is worth having them reviewed.
Will setting up DMARC stop my own emails from being delivered?
Not if you start in monitoring mode. That mode only collects reports. You tighten the policy after confirming that every legitimate sender passes.
We only send a few emails a day. Do we still need this?
Yes. Mailbox providers trust authenticated mail more at any volume, and the records also make it much harder for scammers to send fake invoices that look like they came from your address.
Do I need to change email providers to fix this?
Usually not. Microsoft 365, Google Workspace, and most hosted email services support SPF, DKIM, and DMARC. The work is mostly in your domain's DNS settings and each sending tool's settings.