These three DNS records tell the rest of the world which servers may send email using your domain. Without them your mail is far more likely to be treated as spam, and anyone can forge your address.
SPF
A list of the servers allowed to send mail for your domain. If a message arrives from somewhere not on the list, the receiving server knows to be suspicious. You may only have one SPF record. Two is a common mistake and it invalidates both. If you send through us and through another service – a mailing list provider, an accounts package, a shop – they must all be combined into one record.
DKIM
A cryptographic signature added to each message, letting the receiver confirm it genuinely came from your domain and was not altered on the way. The public half lives in DNS; the private half stays on the sending server.
DMARC
Tells receivers what to do when a message fails the first two, and where to send reports. Start with a policy of none, which changes nothing but produces reports, and only tighten to quarantine or reject once you are confident everything legitimate passes.
Where they come from
If your domain uses our nameservers, SPF and DKIM are set up for our mail servers already. You need to act when you start sending from somewhere else as well – that is when SPF needs updating.
If you are not sure what your records look like, open a ticket and we will check them for you.
