If your outbound email lands in spam or gets rejected, the cause is almost always a missing or misconfigured authentication record. Three DNS records tell receiving mail servers that your messages are legitimate: SPF, DKIM, and DMARC. This guide explains what each one does and how to publish them.
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail using your domain. Add a single TXT record at the root of your domain:
Type: TXT Host: @ Value: v=spf1 include:_spf.yourmailhost.com ~all
Replace include:_spf.yourmailhost.com with the include value your mail provider gives you. If you also send through a marketing platform, add its include in the same record. Never publish two separate SPF records - keep everything in one. End with ~all (soft fail) while testing, then move to -all (hard fail) once you confirm delivery.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message so the recipient can verify it was not altered in transit. Your mail platform generates a public key and a selector (for example s1). Publish it as a TXT or CNAME record:
Type: TXT Host: s1._domainkey Value: v=DKIM1; k=rsa; p=MIGfMA0GCS... (the full key from your provider)
Use the exact selector and value from your provider. Once published, new outgoing mail will carry a valid DKIM signature.
DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails. Start in monitor mode so nothing is blocked while you confirm alignment:
Type: TXT Host: _dmarc Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
After a week or two of clean reports, tighten the policy to p=quarantine and finally p=reject to stop spoofing of your domain.
Send a test message to an external mailbox and open the message headers. You should see spf=pass, dkim=pass, and dmarc=pass. DNS changes can take up to a few hours to propagate, so allow time before retesting.
If you host your domains and mailboxes on a SoftSys managed VPS, our team publishes and validates these records for you as part of onboarding, and sets a matching PTR record on your sending IP so your mail authenticates cleanly from day one.
