scyhost. The big mail providers (Gmail, Outlook, Yahoo and others) check every message to see whether the server that sent it is allowed to send on behalf of your domain at all. If that check fails, the message lands in spam or is rejected. That is what three records in your domain’s DNS are for.
SPF: who may send
SPF is a TXT record listing the servers authorised to send mail for your domain. It looks roughly like this:
v=spf1 +a +mx include:… ~all
- A domain may have only one SPF record. If you use several services (for example hosting and a newsletter service), they all go into the same record.
~allmeans “everyone else is suspicious”, and-allmeans “everyone else is not allowed”. Switch to the stricter rule only once you are sure you have listed every service.
DKIM: a signature on the message
DKIM adds a cryptographic signature to every outgoing message. The receiver finds the public key in your domain’s DNS and checks that the message was not changed on the way and really comes from an authorised server. The public key is a long TXT record with a name like default._domainkey.yourdomain.com.
DMARC: what to do when the check fails
DMARC ties SPF and DKIM to the address in the “From” field and tells the receiver what to do with messages that fail. The record lives at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
p=none: just monitor and send reports. This is where you start.p=quarantine: suspicious messages go to spam.p=reject: suspicious messages are rejected.
The recommended path is to set p=none, read the reports for a few weeks (they arrive at the rua address), and only when all your legitimate services pass, move to quarantine and then reject.
How to set it up at ScyHost
- If your domain uses our nameservers, open cPanel → Email → Email Deliverability. cPanel shows the state of the SPF and DKIM records for each domain there and offers a button to install the suggested values.
- If your DNS is with another provider, copy the suggested SPF and DKIM records from the same screen and add them at that provider.
- Add the DMARC record by hand in Zone Editor (type TXT, name
_dmarc). - If you also send through other services (newsletter, online shop, CRM), add their SPF
includeentries and DKIM keys according to their instructions.
Other habits that help
- Send from an address on your own domain, not from a free service in your domain’s name.
- Make website forms send through real SMTP (with a login), not a function that fakes the sender address.
- For newsletters, use a list of people who agreed to receive mail, and a clear unsubscribe link.
- Keep mailboxes secure: a compromised account sending spam quickly damages the whole domain’s reputation.
Not sure your records are right? Open a ticket with the domain name and we will look at them with you. For business email without a website, see email hosting.