Knowledge base
Guides on SPF, DKIM, DMARC and deliverability — in plain English, with DNS records ready to copy. Free, like the check.
Problems & cases
Why do my emails land in spam? The most common causes and the two-minute check
Your emails end up in the recipients' spam folder? Usually the domain lacks technical authentication (SPF, DKIM, DMARC). The causes in order of frequency — and how to check in two minutes which one applies to you.
SpoofingDMARCSender protectionFraudFake invoices in your company's name: how to protect your domain
Fraudsters send invoices with your sender address? Why that is technically possible, what it causes — and how DMARC with p=reject puts an end to it.
DMARCReportsAnalysisReading and understanding DMARC reports
XML files land in the dmarc mailbox daily — what is actually in them? Report structure, the fields that matter, and how to spot when action is needed.
ForwardingSPFDMARCMailing listsEmail forwarding and DMARC: why SPF breaks along the way
Forwarded mail fails SPF — by design. Why that is, when DKIM saves the day, what mailing lists do differently and when mail is really lost.
SPFDeliverabilitySubdomainsSeveral sending services in one SPF: order instead of the lookup limit
Mail provider, newsletter, shop, CRM — all want into your SPF. How to merge the record, keep the 10-lookup limit in check and when subdomains work better.
Basics
SPF, DKIM, DMARC: the difference in plain language
Three acronyms, one goal: proving your mail is genuine. What SPF, DKIM and DMARC each check, why none is enough alone and in which order to set them up.
DeliverabilityDMARCBasicsGoogle and Yahoo sender requirements: what has been mandatory since 2024
Since February 2024 Google and Yahoo enforce minimum sender rules. What applies to everyone, what is added above 5,000 emails a day — and how to comply.
DKIMDNSBasicsThe DKIM record (_domainkey) explained: structure, example and what each value means
The DKIM record is a TXT record under selector._domainkey.your-domain containing the public key. Example ready to copy, every parameter (v, k, p, t) explained, finding your selector, checking the record.
DMARCDNSBasicsThe DMARC record explained: example to copy and what every parameter means
The DMARC record is a TXT record under _dmarc.your-domain. Three ready-made examples (start, tightening, goal), every parameter explained — p, rua, ruf, pct, sp, adkim, aspf, fo — and the rules records fail on.
Step by step
Creating an SPF record: step by step
How to create your domain's SPF record correctly: collect services, build the record, set it in DNS, verify. With examples for Microsoft 365 and Google.
DKIMDNSDeliverabilitySetting up DKIM: your domain's digital signature
DKIM signs every outgoing email cryptographically. How to set it up at Microsoft 365, Google Workspace and newsletter services — and check that it works.
DMARCDNSSender protectionRolling out DMARC safely: from p=none to p=reject
DMARC protects your domain against forged senders — if you roll it out properly. The risk-free step plan: collect reports, evaluate them, then tighten.
MTA-STSTLS-RPTEncryptionSetting up MTA-STS: enforced encryption for incoming email
MTA-STS forces sending servers to deliver your email encrypted only, and only to your real mail servers. Setup with policy file, DNS record and TLS-RPT.
Providers
Setting up SPF, DKIM and DMARC at World4You: step by step
Domain at the Austrian hoster World4You: the two toggles "SPF Record" and "DKIM Record" under E-Mail & Exchange, the automatic DMARC, DNS management for external mail providers — and the trap with the swallowed underscore.
Microsoft 365Exchange OnlineDKIMSPFDMARCSetting up SPF, DKIM and DMARC for Microsoft 365 (Exchange Online): step by step
Complete email authentication for Microsoft 365: the SPF record at your DNS provider, creating DKIM in the Defender portal, publishing the CNAMEs and switching it on, setting DMARC — with the two typical Exchange Online traps.
Google WorkspaceGmailDKIMSPFDMARCSetting up SPF, DKIM and DMARC for Google Workspace: step by step
Email authentication for Google Workspace: the SPF record with _spf.google.com, generating and starting DKIM in the Admin console under Gmail → Authenticate email, the DMARC record as Google recommends — including wait times and the 2048-bit trap.
Protoncustom domainDKIMSPFDMARCYour own domain at Proton Mail: SPF, DKIM and DMARC step by step
Proton Mail with a custom domain: the wizard under Settings → Domain names, the five steps (verify, addresses, MX, SPF, DKIM/DMARC), the SPF include _spf.protonmail.ch, the three DKIM CNAMEs and Proton's DMARC recommendation — proven in our own operation.
CloudflareDNSDKIMSPFMail records at Cloudflare: SPF, DKIM, DMARC and the proxy trap
Is your DNS zone hosted at Cloudflare? How to set the mail records correctly — and why the orange proxy cloud must stay off for mail records.
StratoDNSSPFDKIMDMARCSetting up SPF, DKIM and DMARC at Strato: step by step
Domain at Strato: the click path to DNS management, the predefined SPF and DMARC rules, custom TXT records with prefix and value — and how DKIM works at Strato.
IONOSDNSSPFDKIMDMARCSetting up SPF, DKIM and DMARC at IONOS: step by step
Domain at IONOS (1&1): the click path to the DNS settings, the ready-made record type "IONOS SPF (TXT)", automatic DKIM including the CNAMEs for external nameservers — and the DMARC record IONOS does not create for you.
ALL-INKLKASDNSSPFDKIMDMARCSetting up SPF, DKIM and DMARC at ALL-INKL: step by step in KAS
Domain at ALL-INKL.COM: the click path in KAS (Tools → DNS settings), the recommended SPF value with spf.kasserver.com, the default DMARC record p=none — and how DKIM works for own and external mail servers.
HetznerkonsoleHDNSSPFDKIMDMARCSetting up SPF, DKIM and DMARC at Hetzner: konsoleH and Hetzner Console
Webhosting or managed server at Hetzner: DKIM with one click in the konsoleH mail security, the automatic default SPF, the DMARC record by hand — and where the DNS records live, depending on whether konsoleH or the Hetzner Console manages the zone.
easynameAustriaDNSSPFDKIMDMARCSetting up SPF, DKIM and DMARC at easyname: Control Panel and CloudPit
Domain at the Austrian hoster easyname: where the DNS records live (old Control Panel or new CloudPit), which SPF record is set automatically, how to activate DKIM — and how the DMARC record is added.