If your invoices are landing in customers’ spam folders, the cause is almost always three DNS records — and the fix is almost always free.
Email authentication is the mechanism that tells the receiving mail server your message genuinely came from you. Get it right and your mail arrives. Get it wrong and legitimate email from your own domain is treated as suspicious — or worse, someone else’s email pretending to be from your domain is treated as legitimate.
It’s configured entirely in DNS, which is why it sits with us.
The three records, in plain English
SPF — who is allowed to send as you
A list of the mail servers permitted to send email using your domain. If a message arrives from somewhere not on the list, the receiving server treats it with suspicion.
Where it goes wrong: a business adds a new tool — a mailing list platform, an invoicing system, a CRM — and follows its setup instructions literally, which say “add this SPF record”. A domain can only have one SPF record, so the new one replaces the old, and suddenly Microsoft 365 isn’t authorised to send your own company’s email. Nothing breaks visibly. Delivery just quietly degrades.
DKIM — proof the message wasn’t altered
A cryptographic signature added to outgoing mail, checked against a key published in your DNS. It proves the message really came from your domain and hasn’t been tampered with in transit.
Where it goes wrong: DKIM gets enabled in the mail platform but the corresponding DNS record is never published, or is published with a typo. The signature then fails every check, which is worse for your reputation than not signing at all.
DMARC — what to do when a check fails
Ties the other two together and tells receiving servers what you want done with mail that fails: let it through, send it to spam, or reject it outright. It also lets you receive reports on who is sending mail claiming to be you.
Where it goes wrong: a strict policy gets applied before the other records are correct, and the business starts silently rejecting its own legitimate email. DMARC needs to be tightened gradually, watching the reports as you go. Skipping that is how companies take down their own mail.
Why this matters more than it used to
The major mailbox providers have progressively tightened their requirements, and bulk senders without correct authentication now see mail rejected rather than merely filtered. What was once best practice is now a condition of delivery.
The commercial impact is straightforward. If your quotes, invoices and order confirmations are landing in junk, you find out through the customer who says they never received it — and you only ever hear about a fraction of those.
Domain spoofing and invoice fraud
The other half of this is defensive. Without a DMARC policy, anyone can send email that appears to come from your domain, and receiving servers have no instruction to stop them.
That’s the mechanism behind invoice redirection fraud: a convincing email, apparently from a company the recipient already trusts, asking for updated bank details. The reputational damage lands on the business whose domain was spoofed, whether or not it was in any way at fault.
A correctly configured DMARC policy makes your domain a considerably harder target.
What we do
- Audit your current records and tell you plainly what’s wrong with them
- Consolidate SPF into a single valid record covering every service that legitimately sends as you
- Publish and verify DKIM keys for each sending platform
- Introduce DMARC in monitoring mode first, then tighten it as the reports come back clean
- Keep all of it coherent as you add and remove tools — which is the part that actually prevents the problem recurring
Because we hold your DNS, none of this requires you to coordinate between providers or chase anyone for access.
Find out where you stand
We can check your domain’s current authentication in a few minutes and tell you whether it’s a problem. Call 01202 835235 or email contact@domainwarden.co.uk.