When customers tell you they are not receiving your emails, or that they land in spam, the most common cause is missing sender verification. Recipients' mail servers (Gmail, Seznam, Microsoft) now check whether a message really comes from a place the domain has authorized. Three records in the domain's DNS are used for this.
SPF: who may send mail on behalf of your domain
An SPF record is a list of servers that are allowed to send emails with your domain. It is a TXT record on the main domain. A typical example for when mail is sent from your hosting:
mujweb.cz. TXT "v=spf1 a mx ~all"
If you send mail through another service besides our server (for example a newsletter sender), it must also be listed in the SPF. A domain may have only one SPF record.
DKIM: the message signature
When sending, the server electronically signs the message. The recipient finds the public key in your domain's DNS and verifies the signature. This confirms that the message was not altered along the way and really comes from your domain. The signing is handled by our server and the key is published as a TXT record. If you are not sure whether DKIM is active for your domain, write to us.
DMARC: what to do when verification fails
DMARC tells recipients what to do with a message that failed both SPF and DKIM, and where to send you reports. It is written as a TXT record at _dmarc.yourdomain:
_dmarc.mujweb.cz. TXT "v=DMARC1; p=none; rua=mailto:dmarc@mujweb.cz"
- p=none: monitoring only, nothing is blocked. A good start.
- p=quarantine: suspicious messages go to spam.
- p=reject: suspicious messages are rejected. Turn it on only after the reports show that all your legitimate mail passes.
Why it matters
Large providers (Gmail, Yahoo) require SPF, DKIM and DMARC, especially from senders who send bulk mail. Without them, your messages risk landing in spam or being rejected.
How to check it
- Send a message to the address generated by an email testing service (for example mail-tester.com) and look at the score.
- In Gmail, open a message you sent to yourself, choose Show original and check that SPF, DKIM and DMARC all show PASS.
General information about DNS can be found under the term DNS, and in more detail in the article Pointing a domain (DNS records). If mail is not arriving, also go through Unsolicited email (spam).