Blog

If your business email is landing in spam, getting spoofed, or randomly failing to deliver, your domain’s email authentication is one of the first places to check.

SPF, DKIM, and DMARC are DNS records that tell receiving mail servers which systems are allowed to send email for your domain. They do not make email perfect, but they do make it much harder for someone to impersonate your business.

For Canadian small businesses, this matters more than many owners realize. A fake invoice from your domain, a spoofed appointment reminder, or a forged legal intake email can damage trust quickly.

What SPF, DKIM, and DMARC Actually Do

These three records work together, but they each have a different job.

SPF: Who Is Allowed to Send

SPF stands for Sender Policy Framework. It lists the mail servers and services that are allowed to send email for your domain.

For example, if your business uses Microsoft 365, Google Workspace, your web host’s mail server, and a newsletter tool, SPF is where you authorize those sending sources.

A basic SPF record looks something like this:

Example only: v=spf1 include:mailprovider.example ~all

Do not copy that exact record for your real domain. Your SPF record must match the services your business actually uses.

DKIM: Was the Message Changed?

DKIM stands for DomainKeys Identified Mail. It adds a digital signature to outgoing email.

When the recipient’s mail server receives your message, it checks the DKIM signature against a public key stored in your DNS. If the signature matches, the receiving server has more confidence that the email was sent by an authorized system and was not altered in transit.

A DKIM DNS record usually lives under a name like this:

Example only: selector._domainkey.yourdomain.ca

The “selector” part depends on your email provider. Google, Microsoft, cPanel, Mailchimp, Constant Contact, and other platforms each generate their own DKIM record names and values.

DMARC: What Should Happen If SPF or DKIM Fails?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It tells receiving mail servers what to do when a message fails authentication checks.

DMARC can tell servers to do nothing, send suspicious messages to spam, or reject them outright.

A starter DMARC record often looks like this:

Example only: v=DMARC1; p=none; rua=mailto:[email protected]

The p=none policy is usually where you start. It lets you collect reports without blocking legitimate email by accident.

Why This Matters for Business Email Deliverability

As of 2026, major inbox providers expect properly authenticated email, especially if you send marketing campaigns, automated notifications, invoices, password resets, or appointment reminders.

If your domain has weak or missing authentication, your messages may still send, but they are more likely to land in junk folders or be treated with suspicion.

This affects everyday business tasks:

• Quote requests and replies to prospects
• Invoices and payment reminders
• Appointment confirmations
• WooCommerce order notifications
• Password reset emails
• Newsletter campaigns
• Contact form notifications from WordPress

If you are still setting up professional email, start with our related guide: Email Hosting: Setting Up Professional Email.

Before You Touch DNS: Make a Sender Inventory

The biggest mistake people make is adding SPF, DKIM, or DMARC records without knowing every service that sends email for the domain.

Take ten minutes and list all the places your business email comes from.

Common senders include:

• Your main mailbox provider, such as Google Workspace or Microsoft 365
• Your web hosting email service
• Your WordPress website contact forms
• Your WooCommerce store
• Your CRM
• Your booking or appointment system
• Your email marketing platform
• Your accounting software
• Your help desk or ticketing system
• Your proposal or e-signature software

If one of those systems sends email as [email protected], it needs to be accounted for.

Tip: Do not guess. Log into each service and look for email authentication, domain authentication, sender verification, or DNS setup instructions.

Step 1: Find Out Where Your DNS Is Managed

SPF, DKIM, and DMARC are DNS records. That means you need access to wherever your domain’s DNS zone is hosted.

This might be:

• Your web hosting control panel
• Your domain registrar
• A DNS provider
• Your IT provider’s account
• Your web designer’s account, if they set it up for you

If your domain uses cPanel hosting, DNS may be managed inside cPanel’s Zone Editor. If you are new to cPanel, this guide may help: cPanel Hosting: A Beginner's Guide.

Be careful here. If you edit the wrong DNS zone, nothing will change. If you delete the wrong records, your website or email can stop working.

Step 2: Set Up or Fix Your SPF Record

Your domain should have only one SPF record. This is a common source of problems.

If you see two separate TXT records that both start with v=spf1, that is usually wrong. Multiple SPF records can cause SPF to fail.

Instead, you combine authorized senders into one SPF record.

What an SPF Record Includes

An SPF record may include:

• include: references to a provider’s SPF rules
• ip4: or ip6: entries for specific sending IP addresses
• a or mx mechanisms, when appropriate
• An ending policy such as ~all or -all

Most small businesses should rely on the exact SPF instructions from their email providers. Do not invent SPF includes or IP addresses.

Soft Fail vs Hard Fail

The ending of your SPF record matters.

• ~all means “soft fail.” Messages from unauthorized servers should be treated as suspicious, but not necessarily rejected.
• -all means “hard fail.” Messages from unauthorized servers should be rejected more aggressively.
• ?all is neutral and usually not very useful for protection.

For many businesses, ~all is a safer starting point while you confirm every legitimate sender is included. Once you are confident everything is authenticated, you may consider moving to stricter settings.

SPF Mistakes to Avoid

• Creating more than one SPF record
• Forgetting your website contact forms
• Forgetting your email marketing platform
• Using a hard fail before testing
• Leaving old providers in SPF forever
• Copying another company’s SPF record

If your website is hosted with Ambrite and your DNS is managed through your hosting account, our support team can help confirm which records belong in your zone. Ambrite’s cloud web hosting uses modern hosting infrastructure with LiteSpeed, NVMe SSD storage, and Imunify360, but email authentication still depends on the correct DNS records for your specific domain.

Step 3: Enable DKIM for Each Email Platform

DKIM is not something you usually write manually from scratch. Your email platform typically generates the DKIM record for you.

You copy the provided DNS record into your DNS zone, then return to the email platform and click a verify or authenticate button.

Where to Find DKIM Settings

Look inside your email provider for sections called:

• Domain authentication
• Email authentication
• DKIM
• Sender authentication
• Verified domains
• DNS records

Each provider handles this differently. Check the official setup documentation for the current steps instead of following an outdated blog post or screenshot.

DKIM for Marketing Tools

If you send newsletters or promotions, your marketing platform may ask you to authenticate your domain separately.

This is normal. Your regular mailbox provider might sign normal business emails, while your marketing platform signs campaign emails using its own DKIM selector.

That means you may have more than one DKIM record. Unlike SPF, multiple DKIM records are normal when they use different selectors.

DKIM for Website Forms

WordPress contact forms often fail deliverability because they try to send mail directly from the web server without proper authentication.

A better approach is to send website form notifications through an authenticated SMTP service that supports SPF and DKIM. This helps your form emails look like legitimate business email instead of random server-generated messages.

This is especially useful for law firms, healthcare practices, real estate agents, contractors, and restaurants that rely on inquiry forms or booking forms.

Step 4: Add a DMARC Record in Monitoring Mode

DMARC is where many businesses get nervous, and for good reason. A strict DMARC policy can block legitimate mail if SPF and DKIM are not set up correctly first.

Start with monitoring mode unless you have already audited every sender.

A typical starter approach uses:

• p=none so mail is not blocked yet
• rua=mailto: to receive aggregate reports
• A dedicated mailbox for DMARC reports

DMARC reports can be messy. They are often XML files, and they can be hard to read without a reporting tool.

If you use a DMARC reporting service, check the provider’s official pricing and setup documentation. Pricing and features change often, and some services are better suited for larger senders than small local businesses.

What DMARC Alignment Means

DMARC does not just ask whether SPF or DKIM passed. It also checks whether the authenticated domain lines up with the visible “From” address.

That visible From address is the address your recipient sees, such as [email protected].

This alignment requirement is why some messages pass SPF technically but still fail DMARC. The message may have been sent through an authorized server, but not in a way that aligns with your domain.

Step 5: Review Reports Before Tightening DMARC

Do not jump straight to p=reject unless you know exactly what is sending email for your domain.

A practical rollout looks like this:

1. Set up SPF and DKIM for your known senders.
2. Add DMARC with p=none.
3. Review reports for legitimate senders that are failing.
4. Fix missing or misconfigured services.
5. Move to p=quarantine when you are confident.
6. Move to p=reject only when you are ready to block unauthenticated mail.

For many small businesses, p=quarantine is already a big improvement. It tells receiving servers to treat failing messages as suspicious without being as final as rejection.

p=reject is stronger protection against spoofing, but it is less forgiving. If your accounting software, booking platform, or website form is not authenticated properly, legitimate messages may fail.

Canadian Business Considerations

SPF, DKIM, and DMARC are not only technical deliverability tools. They also support trust and privacy.

If your Canadian business collects personal information through website forms, email, online orders, or appointment requests, email spoofing can create real risk. A customer may believe they are communicating with your company when they are actually replying to an impersonator.

For privacy basics, see our guide on How to Comply with PIPEDA: Essential Privacy Policy Requirements for Canadian Websites.

A .ca domain does not require special SPF, DKIM, or DMARC syntax. The records work the same way. The Canadian angle is more about customer trust, privacy expectations, and keeping business communication credible.

Special Case: Your Website Sends Email Too

Many business owners set up SPF, DKIM, and DMARC for their mailbox, then forget the website.

Your website may send:

• Contact form notifications
• Quote request confirmations
• WooCommerce order emails
• Password reset emails
• Appointment reminders
• New user notifications
• Membership emails

If those emails come from [email protected] but are sent by the web server without authentication, they may fail DMARC once you tighten your policy.

The fix is usually to connect WordPress or your application to a proper SMTP service. This could be your mailbox provider, a transactional email service, or another platform designed for authenticated sending.

Do not use your personal mailbox password directly in random plugins if you can avoid it. Use the secure method recommended by your provider, such as app-specific credentials or an official integration, when available.

Common DNS Record Examples

These examples are for learning only. Your real records must come from your email providers.

SPF Example

v=spf1 include:provider.example include:marketing.example ~all

This says the domain authorizes two provider sources and uses a soft fail for everything else.

DKIM Example

Name: selector._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=public-key-goes-here

Your provider supplies the selector and public key. Do not shorten the key or add spaces unless your DNS provider specifically instructs you to format it that way.

DMARC Example

Name: _dmarc
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]

Use a mailbox that can handle automated reports. If you use your normal inbox, expect noise.

Troubleshooting: What Went Wrong?

“My SPF Record Looks Right, But SPF Still Fails”

Check whether you have more than one SPF record. That is one of the most common causes.

Also check whether the message is being forwarded. Forwarding can break SPF because the forwarding server may not be authorized to send for your domain.

“DKIM Says Not Verified”

DNS changes can take time to show everywhere. Wait a bit, then try verifying again.

If it still fails, check the record name carefully. DKIM names are easy to paste into the wrong field, especially if your DNS provider automatically appends the domain name.

“DMARC Reports Show Unknown Senders”

Some unknown senders may be spoofing attempts. Others may be real services you forgot about.

Before blocking anything, investigate. Look for accounting tools, CRMs, old marketing accounts, booking tools, or website plugins that may still be sending email.

“My Contact Form Stopped Delivering”

This often happens after moving DMARC to a stricter policy. Your website may not be sending through an authenticated mail service.

Configure your form plugin or website to send through proper SMTP, then test again. If your business depends on leads from your website, test form delivery after every email DNS change.

When Not to Tighten DMARC Yet

There are times when it is smarter to wait before moving to p=quarantine or p=reject.

Hold off if:

• You do not know every system that sends email for your domain
• Your website forms are still using unauthenticated mail
• You recently changed email providers
• You are migrating domains or merging brands
• Your sales team uses multiple outreach platforms
• Your accounting or booking software has not been authenticated
• You cannot monitor DMARC reports yet

Strict DMARC is excellent when your email setup is clean. It is frustrating when your setup is messy.

Best Practices for Small Businesses

Keep your setup simple where possible.

• Use one primary email provider for staff mailboxes.
• Use authenticated SMTP for website forms.
• Authenticate your marketing platform separately.
• Remove old SPF includes when you stop using a service.
• Review email DNS records after changing providers.
• Use a dedicated mailbox or reporting service for DMARC reports.
• Document which services are allowed to send for your domain.

That last point matters. Six months from now, someone will ask why a strange-looking DNS record exists. A simple note can save a lot of confusion.

How Ambrite Can Help

If your domain, website, and email are spread across different providers, SPF, DKIM, and DMARC can get confusing quickly.

Ambrite helps Canadian small businesses with cloud web hosting, WordPress maintenance, and practical website support. Our hosting starts at $7.99/month CAD, and our WordPress maintenance plans start at $49/month CAD.

If your site is hosted with Ambrite, we can help review your DNS records, confirm whether your hosting email is authenticated, and point you in the right direction for provider-specific DKIM setup.

If your WordPress forms are unreliable, that may also be a maintenance issue, not just an email issue. Our WordPress maintenance and security plans can help keep forms, plugins, updates, and security monitoring under control.

Need help sorting out email authentication for your business domain? Contact Ambrite and we can take a look.

This article was written with the help of AI and reviewed by the Ambrite team. Pricing, features, and technical details may change — always verify with official sources before making decisions.