Yes, a business domain needs all three. SPF lists the services allowed to send email as your domain, DKIM adds a digital signature to every message, and DMARC tells the receiving server what to do if a message fails those checks and sends you reports. Gmail, Yahoo and Microsoft now expect all three, and junk or reject mail without them.
SPF: who is allowed to send
A single TXT record on your domain listing your mail provider and any other senders (your website, CRM, invoicing software). It must be one record, and it can only trigger ten DNS lookups, so adding every service blindly breaks it.
DKIM: proof the message wasn't changed
Each sending service signs your emails with a private key; the public key sits in your DNS. If the signature checks out, the receiver knows the message came from an authorised sender and wasn't altered on the way. Microsoft 365 and Google Workspace both need DKIM switched on; it isn't always on by default.
DMARC: the rule and the report
DMARC ties SPF and DKIM to the domain people see in the From line, and sets a policy: p=none (monitor only), p=quarantine (send failures to junk) or p=reject (refuse them). Many businesses add DMARC at p=none and stop there, which satisfies the bulk-sender rules but doesn't stop anyone spoofing your domain.
Where people go wrong
- Two SPF records instead of one
- DKIM left off in Microsoft 365 or Google Workspace
- A forgotten sender, such as the website's contact form
- Jumping to
p=rejectbefore checking the reports, and blocking your own invoices
We set these up and check them on a same-day call, including every service you send from.
