Email authentication: SPF, DKIM and DMARC

If emails sent from your website start bouncing, especially to Gmail addresses, it’s almost always because your domain isn’t set up to prove the mail really comes from you. Two DNS records fix it: SPF and DKIM. This guide explains what they do and how to put them in place.

The step everyone misses

Setting up DKIM has two halves, and the second is the one that gets forgotten. Generating a key in the web office and marking it active is only the first. The matching TXT record has to be published in your domain’s DNS as well, and until it is, your mail stays unsigned and can keep bouncing. Don’t assume you’re finished when the key is made.

Why your emails might be bouncing

Since Google tightened its sender rules in 2024, Gmail rejects mail that can’t prove where it came from through either SPF or DKIM (the bounce usually mentions code 550-5.7.26 and an ‘unauthenticated’ sender). Sending to a lot of people at once is hit hardest, but forwarded mail bounces for the same reason. It genuinely did use to work: Google changed the rules, not you and not us.

SPF: let our server send for you

An SPF record lists the servers allowed to send email for your domain. Mail from your website goes out through our server, so your SPF record needs to include it:

a:smtpweb.uk.endis.com

If your SPF record only lists Outlook, Google or another provider, mail sent through us will fail the check. Add our server alongside whatever else your email provider recommends. If you don’t have an SPF record yet, a TXT record of v=spf1 mx a:smtpweb.uk.endis.com ~all is usually enough to start with.

DKIM: sign your mail so it’s trusted

DKIM adds a signature to your mail so providers can confirm it really came from your domain. There are two parts, and you need both:

In the web office, generate a DKIM key under your email authentication settings (you’ll need the Site Settings permission).
Publish the TXT record it gives you, whose name looks like hubb<id>uk._domainkey, in your domain’s DNS.

Generating the key and marking it active doesn’t sign anything on its own. Your mail is only signed once that DNS record is live. If you ever need to, you can delete a key and generate a fresh one.

DMARC

Once SPF and DKIM are in place, a DMARC record tells receiving providers what to do with mail that fails the checks, and lets you see reports on how your domain is being used. It’s another TXT record on your domain. If you’d like a hand setting it up, get in touch.

Good to know

These records apply to your whole domain, not to individual addresses. Switching from one address to another on the same domain won’t change anything on its own.
You need a separate DKIM key for every way you send: the website, Microsoft 365, Mailchimp and so on.
While you’re getting a domain sorted, you can keep things moving by sending from an address on a domain that’s already set up correctly.

Still stuck? We’re real people.

Raise a support ticket and our UK team will get back to you.

Contact support