If customers never see your invoices, quotes, or contact form replies, the problem is usually not your WordPress theme. It is email authentication. Gmail, Outlook, and Yahoo check three DNS records before they trust mail from your domain: SPF, DKIM, and DMARC.
This guide explains what each record does, how to set them up on a typical small business hosting setup, and how to verify that messages actually land in the inbox. No jargon wall. Just the steps that fix most “your email went to spam” tickets.
Why business email ends up in spam
Mailbox providers assume the worst when a message fails authentication. Common triggers for Connecticut shops, contractors, clinics, and other small teams:
- You send from
you@yourdomain.com, but DNS never says which servers are allowed to send for that domain. - WordPress contact forms use the server’s default mail function with no proper signing.
- Marketing tools (newsletter, CRM, booking) send on your behalf, but those services are missing from SPF or DKIM.
- You have no DMARC policy, so receivers have no instruction when a message looks forged.
Gmail expects SPF or DKIM for all senders, and SPF, DKIM, and DMARC together for bulk mail. Even if you only send a few dozen messages a day, the same records improve inbox placement and protect your brand from spoofing.
The three records in plain English
SPF (who may send)
SPF is a TXT record on your root domain. It lists the services allowed to send mail as your domain. Think of it as a guest list for outbound email.
A simple pattern looks like this (your host or email provider will give you the exact include):
v=spf1 include:example-mail-provider.com ~all
- One SPF record only on the root domain. Multiple SPF TXT records break validation.
- Merge includes into a single line when you use hosting email plus a newsletter tool.
- Stay under 10 DNS lookups. Too many nested includes can fail SPF even when the syntax looks fine.
~all(soft fail) is a safe default while you test. Move to-allonly after you know every legitimate sender is listed.
DKIM (proof the message was not altered)
DKIM adds a cryptographic signature to each message. The public key lives in DNS (often a CNAME or TXT under a selector like default._domainkey or a provider-specific name). Receivers fetch that key and check the signature.
If SPF says who may send, DKIM proves the body and key headers were not tampered with in transit. You want both.
- Enable DKIM in your email hosting panel or mailbox product, then publish the DNS record they show you.
- If you send through more than one platform, each platform usually needs its own selector and key.
- Do not invent a DKIM value. Copy the exact host and value your provider displays.
DMARC (what to do when checks fail)
DMARC is another TXT record, almost always at _dmarc.yourdomain.com. It tells receivers how strict to be when SPF or DKIM fails, and where to send aggregate reports.
A starter record:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1
p=nonemonitors without blocking. Start here for a week or two.p=quarantineasks receivers to treat failures as suspicious (often spam).p=rejectasks receivers to refuse failing messages. Use this only after reports look clean.- Create the mailbox you put in
rua=so reports have somewhere to land, or use a DMARC report service you trust.
Step-by-step setup checklist
1. List every system that sends as your domain
Write this down before you touch DNS:
- Mailbox product on your hosting account (day-to-day email)
- WordPress transactional mail (forms, password resets, WooCommerce notices)
- Newsletter or CRM tools
- Booking, invoicing, or support tools that send from your domain
Miss one sender and SPF will look “set up” while half your mail still fails.
2. Confirm where DNS is edited
DNS lives wherever your domain’s name servers point. That may be your registrar, your hosting DNS, or a separate DNS host. Changing records in the wrong panel does nothing. If you are unsure, check the name servers on a public lookup, then open that provider’s DNS zone editor.
3. Publish SPF
- Open the DNS zone for the bare domain (example.com, not www).
- Add or edit a single TXT record for SPF.
- Include your email host and any third-party senders on one line.
- Remove duplicate or leftover SPF TXT records from old hosts.
- Save and wait for DNS to propagate (often minutes, sometimes up to 24–48 hours).
4. Turn on DKIM and publish the key
- In your email hosting controls, enable DKIM for the domain.
- Copy the selector hostname and the TXT or CNAME value exactly.
- Create that record in DNS.
- Repeat for each extra sending platform that offers its own DKIM.
5. Add a monitor-mode DMARC record
- Create a TXT record at
_dmarcwithp=noneand a report address you control. - Leave it in monitor mode until you review a batch of reports or sample headers.
- Tighten to quarantine, then reject, only when legitimate mail consistently passes.
6. Fix WordPress form and notification mail
WordPress often tries to send through the server without proper SMTP authentication. That path is fragile and frequently unsigned.
- Install a reputable SMTP plugin (WP Mail SMTP, FluentSMTP, Post SMTP, or similar).
- Authenticate with your real mailbox or a transactional provider that supports your domain.
- Send a test from the plugin, then check headers for SPF and DKIM pass.
- Keep the From address on a domain you authenticate. Avoid random free webmail From addresses for business forms.
How to verify it worked
Do not trust a green check in a DNS UI alone. Test real messages.
- Send from your business mailbox to a personal Gmail address.
- In Gmail, open the message, choose “Show original,” and read the SPF, DKIM, and DMARC lines.
- You want SPF PASS, DKIM PASS, and DMARC PASS (alignment matters: the visible From domain should match what SPF/DKIM authenticated).
- Send a second test from your contact form and from any newsletter tool. Each path needs its own clean result.
- Optional: use a mail-tester style service for a second opinion, then still confirm with Gmail’s original headers.
If DMARC fails while SPF or DKIM passes, alignment is usually wrong. A common case is sending with a From domain that does not match the domain you authenticated. Align the From address with the domain that has the records.
Mistakes that keep mail in spam
- Two SPF records. Merge them. Do not stack separate TXT rows that both start with
v=spf1. - Old host still in SPF, new host missing. After a migration, rewrite SPF and re-enable DKIM on the new platform.
- DKIM enabled in the panel but never added to DNS. The key has to be public in DNS or signatures cannot verify.
- Jumping straight to
p=reject. You can block your own invoices if a CRM was never included. - Shared “From” names with no mailbox. Use real addresses you monitor, such as
billing@orhello@. - Ignoring forwarded mail. Simple forwarding can break SPF. Prefer rewriting/forwarding setups that preserve authentication, or rely on DKIM + DMARC alignment.
What good looks like for a small business
A practical target for most local companies:
- One clean SPF record covering hosting email and known tools
- DKIM on the primary mailbox platform (and on the newsletter tool if you use one)
- DMARC at
p=nonewith reporting, then tighten after two clean weeks - WordPress sending through authenticated SMTP, not the bare server mailer
- A short internal note listing every approved sending service so the next vendor add-on does not break DNS
You do not need a corporate security team for this. You need accurate DNS and one careful test pass.
When to ask your host for help
Open a support ticket (with your domain name and a screenshot of “Show original” results) if:
- You cannot find DKIM controls for your mailbox product
- DNS is locked or managed on your behalf and you need the exact SPF include and DKIM hostnames
- Mail still fails authentication after records have propagated for more than a day
- You recently moved hosting or email and old records are mixed with new ones
If you host with KDigital Hosting, sign in to your client area and open a ticket from the account that owns the domain. Include whether the problem is mailbox mail, WordPress forms, or a third-party tool. That detail saves a round of back-and-forth.
Quick reference
- SPF: one TXT on the root domain listing allowed senders
- DKIM: provider-generated key published at a selector hostname
- DMARC: TXT at
_dmarcstarting withp=none, then tighten - WordPress: authenticated SMTP plugin, From address on your domain
- Proof: Gmail “Show original” with SPF, DKIM, and DMARC all passing
Get those five right and most small business deliverability problems shrink fast. The rest is list hygiene, content that people actually want, and not blasting cold mail from a brand-new domain.
Need a hand tying DNS, hosting email, and WordPress together on one stack? Look at KDigital Hosting plans or contact support from your client area with your domain and a failing header sample.
