If customers say your invoices or replies “never arrived,” and they aren’t in your sent folder issue, the problem is often three DNS records you’ve probably never heard of: SPF, DKIM, and DMARC. Without them, Gmail, Yahoo, and Outlook increasingly treat your business email as suspicious by default, and since Google tightened enforcement in late 2025, missing these records can mean your emails are rejected outright, not just filtered to spam. Here’s what they actually do, and how to fix it.
Key Takeaways
Why This Suddenly Matters More
Email spoofing, where someone sends a message that looks like it’s from your business, has always been a security concern. In response, Google, Yahoo, and Microsoft have progressively tightened what they require from senders before trusting a message. As of late 2025, Google enforces these checks more strictly, and non-compliant email can now be rejected at the point of sending, not just flagged as spam once it arrives. If you send even a moderate volume of email to Gmail or Outlook addresses, which covers most of your customers, this isn’t optional anymore.
SPF: Sender Policy Framework
What it does: SPF is essentially a whitelist. It’s a DNS record that lists exactly which mail servers are allowed to send email on behalf of your domain. When someone else’s server tries to send email pretending to be “you@yourbusiness.co.ug,” the receiving mail server checks your SPF record, sees that server isn’t on the approved list, and treats the message with suspicion.
In plain terms: It’s like a guest list at the door. Only servers on your list get to say they’re speaking for your business.
DKIM: DomainKeys Identified Mail
What it does: DKIM attaches a digital signature to every email you send, generated using a private key only your mail server has. The receiving server checks that signature against a public key published in your DNS. If the message was altered in transit, or wasn’t actually signed by your server, the signature fails to verify.
In plain terms: It’s like a wax seal on a letter. If the seal is broken or doesn’t match, the recipient knows something’s off.
DMARC: Domain-based Message Authentication, Reporting and Conformance
What it does: DMARC ties SPF and DKIM together and tells receiving mail servers what to actually do when a message fails those checks: let it through, send it to spam, or reject it outright. It also gives you reports showing who is sending email using your domain, which is often how businesses first discover someone has been spoofing their brand.
In plain terms: SPF and DKIM check identity; DMARC decides the consequence when identity can’t be confirmed, and reports back to you on what’s happening.
How to Set Them Up
- Get the exact values from your email provider. Google Workspace, Zoho Mail, and most hosting providers give you the specific SPF, DKIM, and DMARC record values to use, usually in their admin dashboard or setup documentation. Don’t guess these values yourself.
- Log into your domain’s DNS management. This is usually through your domain registrar or hosting control panel, wherever you manage your domain’s other DNS settings.
- Add the SPF record as a TXT record, following your provider’s exact syntax. If you use more than one service to send email (for example, both Google Workspace and a separate marketing tool like Mailchimp), your SPF record needs to include all of them, or the ones you leave out will fail.
- Add the DKIM record as a TXT record, again using the exact value your provider gives you. This is usually a long string of characters.
- Add a DMARC record as a TXT record. Start with a monitoring-only policy (
p=none) so you can see the reports without risking legitimate email being blocked, then tighten it top=quarantineorp=rejectonce you’ve confirmed everything passes correctly. - Wait for DNS propagation, usually a few hours, then use a free checking tool (search “SPF DKIM DMARC checker”) to confirm all three are correctly set up.
If you’re not comfortable editing DNS records, this is a quick task for a developer or your hosting provider, usually well under an hour once they have the values from your email provider. See our guide on setting up professional business email in Uganda if you haven’t chosen a provider yet.
Frequently Asked Questions
Do I need all three, or is one enough?
All three, ideally. SPF and DKIM alone verify identity but don’t tell receiving servers what to do about failures. DMARC is what actually enforces the policy and gives you visibility into abuse. Setting up only SPF or only DKIM leaves gaps that DMARC is specifically designed to close.
Will this cost me anything?
No, SPF, DKIM, and DMARC are free DNS records. There’s no subscription or license fee. The only cost is the time to set them up correctly, or a small one-time fee if you pay a developer to do it for you.
How do I know if this is actually why my emails are going to spam?
Use a free SPF/DKIM/DMARC checking tool and send a test email to a service like mail-tester.com, which shows exactly which checks pass or fail. If any of the three are missing or misconfigured, that’s very likely at least part of your deliverability problem.
For the full picture of setting up reliable business communication, see our guide on business email setup in Uganda, and for everything else your website needs, start with our complete guide to web design in Uganda.