DebutBoard / Guides / Email at your own domain that doesn't land in spam

Email at your own domain that doesn't land in spam

An address like you@yourbusiness.com looks more trustworthy than a free webmail address, but only if your mail actually arrives. Three records in your domain settings decide that. This guide covers what each one does and how to check it.

Last checked October 15, 2026 · about 5 minutes to read · drafted and checked with AI help, here's how

Having a website at yourbusiness.com doesn't automatically give you email at it. And once you do have email there, the big inbox providers (Gmail, Yahoo and Outlook) want proof that a message claiming to come from your domain really did. Without that proof, your quotes and invoices can land in spam, or not arrive at all.

The proof comes from three records you add to your domain's DNS settings: SPF, DKIM and DMARC. (DNS is the settings page, usually at your domain company, that controls where your domain's website and email go. A "record" is one line in it.) You don't need to understand how they work inside. You need to know what each one is for, get them added, and check that they pass.

First decide: forwarding or a real mailbox?

There are two ways to have an address at your domain.

Forwarding only

Mail sent to hello@yourbusiness.com is passed on to an inbox you already have, like a Gmail account. Many domain companies and DNS hosts offer this. Cloudflare's Email Routing, for example, is included in its free plan and forwards incoming mail to an address you already use.

The catch: forwarding is for receiving. Cloudflare says plainly that Email Routing doesn't support sending or replying from your domain, so your replies go out from your personal address. That's fine for a contact address on a website. It looks less professional for quotes and invoices.

A real mailbox

An email provider such as Google Workspace, Microsoft 365 or many smaller companies hosts a mailbox at your domain. You send and receive as you@yourbusiness.com. It costs a monthly fee per user, and it's what most businesses end up with. Your provider will give you the exact DNS records to add. The rest of this guide explains what those records do.

SPF: who is allowed to send as you

SPF is a single line of text in your DNS that lists the services allowed to send email for your domain: your email provider, and anything else that sends on your behalf, like an invoicing tool or a newsletter service. A typical one for a Google Workspace user looks like this:

v=spf1 include:_spf.google.com ~all

Two rules catch people out:

  • One SPF record per domain. If you add a second one for a new service instead of editing the first, SPF breaks entirely. Add the new service to your existing line.
  • A limit of ten lookups. Each include: (and a few other parts) makes the receiving server look something up. The standard allows at most ten. Go over and SPF fails. If you use lots of services that send email for you, ask your email provider to check you're under the limit.

DKIM: a signature on every message

DKIM adds an invisible digital signature to each message you send. The receiving server checks it against a public key published in your DNS. If it matches, the message wasn't forged or changed along the way.

You don't write the DKIM record yourself. Your email provider generates it in its admin panel. You copy it into your DNS as a TXT record with a name like google._domainkey, then go back to the provider and switch signing on. Any other service that sends mail as your domain, such as a newsletter tool, will have its own DKIM setup steps. Do those too.

DMARC: what to do when a check fails

DMARC ties the other two together. It's one more DNS record, named _dmarc, that tells receiving servers what to do with mail that claims to be from your domain but fails the checks. It has three settings:

PolicyWhat it tells receivers
p=noneDon't do anything differently. Just send me reports. This is where everyone should start.
p=quarantineTreat failing mail as suspicious, which usually means the spam folder.
p=rejectRefuse failing mail outright.

A starter DMARC record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com

The rua part says where to send the summary reports. They're machine-readable files, not easy reading, but free and paid tools can turn them into a readable list of who's sending as your domain.

DMARC also checks that the SPF or DKIM pass is for your own domain, the one in the visible From address, not just for the service that sent the mail. That's why a newsletter tool sending "as" you can fail DMARC until you finish its DKIM setup.

Go slowly with DMARC. Start at p=none. Read the reports for a few weeks to make sure everything that legitimately sends as you is passing. Only then think about quarantine or reject, or you may block your own invoices.

What Gmail, Yahoo and Outlook require

The big inbox providers have tightened their rules since 2024:

  • Gmail (since February 2024): anyone sending to personal Gmail addresses needs SPF or DKIM, and has to keep the spam-complaint rate under 0.3%. Bulk senders, roughly 5,000 or more messages a day to Gmail, also need both SPF and DKIM, a DMARC record (p=none is enough), a From address that aligns with SPF or DKIM, and one-click unsubscribe on marketing mail. Google stepped up enforcement in November 2025, and failing mail can be rejected outright.
  • Yahoo (also since February 2024) has nearly the same rules, and asks bulk senders to honor unsubscribes within two days.
  • Outlook.com, Hotmail and Live (since May 5, 2025): domains sending more than 5,000 emails a day to those addresses must pass SPF and DKIM and have DMARC of at least p=none, aligned with SPF or DKIM. Mail that doesn't comply goes to Junk first and can then be rejected.

Most small businesses never come near 5,000 messages a day. The basic rule still applies to everyone, though, and having all three records set up is simply what a legitimate sender looks like now.

How to check your setup

  1. Send a message from your business address to a personal Gmail account.
  2. Open it in Gmail on a computer, click the three-dot menu next to Reply and choose Show original.
  3. Gmail shows a short summary above the raw message details, with a line each for SPF, DKIM and DMARC. You want PASS on all three.

If one fails, the most common causes are a second SPF record, a typo in a pasted record, DKIM that was published in DNS but never switched on at the provider, or a sending tool that isn't listed in SPF. DNS changes can also take a while to spread, so give a fresh change an hour or two before you worry.

Habits that keep you out of spam

  • Send newsletters from a proper newsletter service with its own DKIM set up for your domain, not by putting 200 addresses in BCC.
  • Only email people who asked to hear from you. The rules for marketing email are in the first-visitors guide.
  • Make unsubscribing easy and honor it fast. A complaint costs you more than an unsubscribe.
  • Keep your domain renewed. If a domain expires, its email stops working too.

Sources

Just launched a site? List it on the debut board. It's free, there's no account, and new listings are reviewed before they go up.