You wrote the quote. You pressed send. Your sent folder says it went. The customer never replied, and three weeks later you find out they went with someone else because, as far as they were concerned, you never got back to them.

This happens constantly, and the usual cause is not your email provider, your writing, or bad luck. It is three small records in your domain settings that decide whether receiving mail servers believe your email is really from you.

Why nothing looks broken

Every other website problem announces itself. The site goes down and the phone rings. A page looks wrong and somebody tells you. Email authentication is the exception: when it fails, everything looks completely normal from where you sit. The message leaves. It just gets filed into junk, or silently rejected, at the other end.

The customer does not tell you, because they never saw it. You do not experience a technical fault. You experience a quiet, unexplained fall in how many enquiries turn into work.

The three records, in plain English

  • SPF is a list. It names the servers allowed to send email using your domain. If your mail comes from Microsoft 365 and your quoting software sends on your behalf too, both need to be on the list.
  • DKIM is a signature. Your mail server signs each message with a private key, and the matching public key sits in your DNS so the receiver can check it. It proves the message came from you and was not altered on the way.
  • DMARC is the instruction. It tells receiving servers what to do when a message fails the first two: let it through, put it in junk, or reject it. Without DMARC the other two are advisory, and anyone forging your domain gets the benefit of the doubt.

Google and Yahoo both tightened their requirements for bulk senders, and the direction of travel across the industry is the same. Mail from a domain that cannot prove who it is gets treated with suspicion.

The second problem: someone else spending your good name

Missing records do not only cost you delivery. They let anybody put your domain in the from line of their own email. Their spam earns your domain the bad reputation. You get flagged for messages you never sent, and nothing anywhere tells you it is happening.

A domain marked as a spam source is hard to rehabilitate. Publishing three DNS records is a great deal cheaper than rebuilding a sender reputation.

What to do about it

The fix is not a project. It is three text records added to your DNS by whoever manages it, usually your web company, your IT provider or your domain registrar. For most small businesses it is under an hour of somebody's time. The hard part is knowing it needs doing.

If you want to check first, the records are public: anyone can look up whether your domain publishes them. Ask whoever manages your DNS whether you have SPF, DKIM and DMARC, and treat any hesitation as an answer.

Fixing it once is not the job

Here is the part almost everybody gets wrong. They fix it, and assume it is done forever. It is not. Every time you add a tool that sends email on your behalf, a newsletter platform, a booking system, a CRM, your SPF record needs to know about it, and typically nobody updates it. A DNS change during a website move can drop the records entirely.

We check these every week and tell you in plain English when something changes, alongside your certificate expiry, your domain registration and your security headers. Not because the fix is hard, but because knowing it is still right next month is the part nobody has time for. More on how the email checks work.