Emails don’t land in junk by accident anymore.
Major providers like Google, Yahoo and Microsoft actively reject or downgrade emails that can’t prove where they came from. If your domain isn’t correctly configured, your perfectly legitimate email may never reach the inbox – no matter how well it’s written.
A few simple domain‑level checks can make a huge difference.
Why emails end up in junk
“Hey, did you get my email?”
“No?”
“Oh… it’s probably in your junk.”
That conversation causes more damage than it first appears. Missed emails mean missed opportunities, slow responses, and unnecessary friction with customers and suppliers.
While content and wording still matter, modern spam filtering is heavily driven by trust and authentication. Email providers expect you to prove that messages sent from your domain are genuinely from you. If you can’t, your email is treated with suspicion or blocked entirely.
First, a couple of key terms
What is a domain name?
Your domain name is your digital identity. It’s your website address and the part after the @ in your email address.
Using your own domain for email gives a professional image, but more importantly, it gives you control. You can only secure and protect email that comes from a domain you own.
What is DNS?
DNS stands for Domain Name System. Think of it as a global address book that tells systems where things live on the internet.
DNS is made up of records, such as:
- A records, which point a name to an IP address
- CNAME records, which act as aliases
- TXT records, which store text-based information
TXT records are especially important for email security, as several modern standards rely on them to verify trust.
How DNS protects your email
When an email is received, the recipient’s mail server checks your DNS records to confirm:
- Who is authorised to send email for your domain
- Whether the message has been altered
- What to do if something doesn’t match expectations
The following three checks are now considered essential.
1) SPF – who is allowed to send email for your domain?
SPF stands for Sender Policy Framework. It allows you to publish a list of systems that are permitted to send email using your domain name.
It is stored as a TXT record in DNS.
A simple example might look like this:
v=spf1 include:spf.protection.outlook.com include:mailcampaignplatform.com -all
In plain English, this means:
- Allow Microsoft 365 to send email
- Allow the email campaign platform
- Reject anything else
Why this matters:
- Email providers actively check SPF
- Spoofed emails fail SPF automatically
- Incorrect SPF is one of the most common deliverability problems
You must include every service that sends email from your domain, including:
- Your email platform
- Website contact forms
- CRM systems
- Accounting software
- Marketing and campaign tools
Missing even one legitimate sender can cause genuine emails to fail.
2) DKIM – proving the email hasn’t been tampered with
DKIM stands for DomainKeys Identified Mail. It uses cryptography to prove that:
- The email really came from the sending system
- The content wasn’t altered during delivery
Each email is digitally signed by the sending system. Your DNS publishes a matching public key that allows receiving servers to verify that signature.
If the signature checks out, trust increases. If it’s missing or invalid, trust drops sharply.
- DKIM is expected by default
- Proper DKIM setup significantly improves inbox placement
- DMARC relies on DKIM to work correctly
Each system that sends email must have DKIM enabled, not just your main mail server.
3) DMARC – deciding what happens when checks fail
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It ties SPF and DKIM together and lets you set a policy for failures.
DMARC allows you to tell email providers what to do when authentication fails:
- Allow the message
- Quarantine it (usually send to junk)
- Reject it outright
It also provides reporting, so other mail servers can automatically tell you when something using your domain fails checks. This is often how organisations discover:
- Forgotten systems still sending email
- Misconfigured third-party services
- Attempts to impersonate or spoof their domain
Publishing DMARC without enforcement is no longer enough. Major email providers now expect domains to move beyond monitoring and actively protect against abuse.
Summary
Email deliverability is about trust, not guesswork.
Correctly configured SPF, DKIM and DMARC:
- Keep legitimate emails out of junk
- Block spoofing and impersonation
- Protect your brand reputation
- Meet modern email provider requirements
If these records are missing or incorrect, even well-written emails may never be seen.
If you’d like help reviewing or fixing your email security settings, get in touch. We’ve helped many clients put these protections in place and make sure their email gets where it should – the inbox.
Book a call with Nick:
