Improving Email Delivery (SPF, DKIM, DMARC)
If your emails sometimes land in the recipient's spam folder, a few behind-the-scenes settings can make a big difference. This guide explains SPF, DKIM and DMARC in plain English and shows you how to switch them on.
Why legitimate email lands in spam
Mail providers like Gmail and Outlook are cautious about who they trust. To protect people from scams, they check whether an email genuinely came from your domain. If your domain doesn't clearly prove it sent the message, the email can be filtered to spam, even when it's perfectly legitimate.
SPF, DKIM and DMARC are three standards that prove your mail is genuine. Together they tell receiving mail servers, "yes, this email really is from us." Turning them on improves the chances your email lands in the inbox.
SPF — already set up for you
SPF (Sender Policy Framework) lists which servers are allowed to send email for your domain. When you enable email authentication on your hosting, an SPF record is added automatically, so there's nothing you need to do here.
DKIM — turn this on
DKIM (DomainKeys Identified Mail) adds a tamper-proof digital signature to every email you send, so receiving servers can confirm the message wasn't altered along the way. Here's how to enable it:
- In your control panel, go to Websites.
- Select your website.
- Open the Domains tab.
- Select your domain.
- Go to Email authentication.
- Turn on DKIM.
That's it. Your SPF record is applied automatically at the same time, so SPF and DKIM are both covered.
DMARC — the final piece
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together. It tells receiving servers what to do with email that fails those checks, which helps stop scammers from impersonating your domain.
DMARC is set up by adding a single TXT record to your domain's DNS. A simple, gentle starting record looks like this:
- Name / host: _dmarc
- Type: TXT
- Value: v=DMARC1; p=none; rua=mailto:you@yourbusiness.com.au
Here's what that means:
- v=DMARC1 says this is a DMARC record.
- p=none is a monitoring-only policy. It doesn't block anything yet, so it's safe to start with while you make sure everything is working.
- rua=mailto:... is where summary reports are sent, so you can see how your email is performing. Use one of your own addresses.
Once you're confident your email is passing SPF and DKIM, you can tighten the policy later (for example, to p=quarantine and then p=reject) for stronger protection against impersonation.
Next steps
Enabling DKIM (and adding a DMARC record) is one of the best things you can do to keep your email out of spam folders. If you'd like a hand turning on DKIM, adding your DMARC record, or working out why messages are still being filtered, open a support ticket from your account and our team will sort it out with you.