Why it happens
Major email providers including Google, Yahoo and Microsoft now expect senders to prove they're genuine, and have tightened requirements significantly since 2024, especially for organisations sending in volume. If your domain can't prove who's allowed to send for it, your emails look exactly like the forgeries criminals send.
The three records
| Record | What it does |
|---|---|
| SPF | Lists the services allowed to send email for your domain (e.g. Microsoft 365, your newsletter tool) |
| DKIM | Adds a digital signature proving the email wasn't altered and really came from you |
| DMARC | Tells receivers what to do with emails that fail the checks, and sends you reports |
How to fix it
- List every service that sends email as your domain: Microsoft 365, website forms, invoicing, newsletters, CRM.
- Publish one correct SPF record that includes them all (only one SPF record is allowed).
- Enable DKIM in Microsoft 365 and in each sending service.
- Start DMARC at
p=noneto collect reports, fix anything failing, then move toquarantineand finallyreject.
