If your business sends email from your own domain - and it should - then SPF, DKIM, and DMARC records are not optional. They're the difference between your emails landing in inboxes and landing in spam folders, and between your domain being used to send phishing emails to your clients or not.
This isn't theoretical. Domain spoofing attacks on small businesses are common and increasingly sophisticated. The good news: these three DNS records are not hard to set up, and most Canadian hosting providers - including dotCanada - give you the tools to do it.
What Each Record Actually Does
SPF (Sender Policy Framework) tells the world which mail servers are authorized to send email on behalf of your domain. It's a DNS TXT record that looks something like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
This record says: "Email from our domain is legitimate only if it comes from Google's servers or SendGrid's servers. Anything else should be treated with suspicion." The ~all at the end means "soft fail" - suspicious but not outright rejected. Many setups use -all for a hard fail, which is stricter.
Without SPF, any mail server anywhere can claim to be sending email from your domain. Spammers exploit this constantly.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. Your mail server signs each message with a private key, and recipients can verify that signature against a public key published in your DNS. If the signature checks out, the email wasn't tampered with in transit and genuinely came from an authorized sender.
DKIM records look like this in DNS:
selector._domainkey.yourdomain.ca TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
The long string at the end is your public key. Your email provider generates this for you - you just publish it in DNS.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do when messages fail those checks. It also gives you a reporting mechanism so you can see when someone is trying to spoof your domain.
A basic DMARC record:
_dmarc.yourdomain.ca TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.ca"
The p=quarantine policy says: if an email fails SPF and DKIM checks, send it to spam. The p=reject policy is stricter: reject it outright. Start with p=none (monitoring only) to see what's happening before you enforce anything.
Why This Matters for Your Canadian Business
Two reasons beyond deliverability:
Phishing protection for your clients. If a fraudster spoofs your domain to send fake invoices or scam emails to your customers, the damage to your reputation can be severe. DMARC with a reject policy makes spoofing your domain technically very difficult.
Google and Microsoft require it now. As of 2024, both Google and Microsoft significantly tightened their requirements for bulk senders. Even for smaller volumes, having SPF, DKIM, and DMARC in place dramatically improves deliverability to Gmail and Outlook inboxes - which is where most of your clients' email lands.
How to Set These Up
Step 1: Set up SPF. Log into your DNS management panel (through your registrar or hosting provider). Add a TXT record at your root domain (@) with the appropriate SPF value for your email provider. If you use Google Workspace, they provide the exact record. Same with Microsoft 365, Zoho, and any other provider.
Step 2: Enable DKIM through your email provider. Most providers (Google Workspace, Microsoft 365) have a DKIM setup page in their admin console. They generate the key pair, give you the DNS record to publish, and you add it. Then you click "Authenticate" and they verify it's in place.
Step 3: Add DMARC. Start with p=none and add a reporting address so you can see what's hitting your domain. After a few weeks of monitoring reports, move to p=quarantine, then eventually p=reject.
Tools to check your setup: MXToolbox (mxtoolbox.com) and Mail Tester (mail-tester.com) will scan your DNS records and tell you what's misconfigured. Run a check after setup.
Common Mistakes
- Multiple SPF records. You can only have one SPF TXT record per domain. If you have two, both are ignored. Combine all your authorized senders into one record.
- Forgetting subdomains. If you send email from
newsletter.yourdomain.ca, that subdomain needs its own SPF and DKIM setup. - Going straight to
p=rejectwithout monitoring first. You may have legitimate senders (a third-party form tool, an invoicing platform) that aren't in your SPF record. Start withp=none, review the reports, fix gaps, then tighten the policy.
Getting this right takes an hour. Not getting it right costs you deliverability, reputation, and potentially your clients' trust. It's worth the hour.
