A customer says your quotation landed in spam. Another cannot find an invoice. Before asking everyone to whitelist your address, check whether receiving systems can authenticate the services sending email for your business.

SPF, DKIM and DMARC help establish domain authenticity. They are an important starting point, but passing authentication does not guarantee inbox delivery. Recipient systems also assess reputation, history and other signals.

What does SPF check?

Sender Policy Framework identifies authorised sending sources through a DNS TXT record. It checks the domain used in the message envelope, which can differ from the From address a customer sees.

Your business may send through Microsoft 365, a CRM, billing software and a newsletter platform. Inventory these sources before editing SPF. Otherwise, a change intended to protect your domain could leave legitimate applications unauthorised.

Publish only one SPF record for each sending domain or subdomain. Multiple separate SPF records are a common configuration mistake. Subdomains need their own SPF configuration; they do not inherit the parent domain’s record.

What does DKIM do?

DomainKeys Identified Mail adds a digital signature to important message elements. Receiving systems use the signing domain’s public key to verify the signature and detect changes to signed content.

For Microsoft 365 custom domains, obtain the exact DKIM CNAME values from your tenant’s Defender portal or Exchange Online configuration. Do not copy another organisation’s example values. Microsoft uses tenant-specific targets, and older and newer configurations can differ.

Publishing DNS entries is only part of the work: confirm signing is enabled and inspect a received test message to verify the expected signing domain.

Why does DMARC matter?

DMARC connects authentication to the visible From domain. A message passes when SPF passes with domain alignment, or DKIM passes with domain alignment. Both mechanisms do not have to pass, although configuring both improves resilience.

DMARC also publishes a requested handling policy for failures and can direct aggregate reports to a reporting destination. A monitoring policy, p=none, helps with discovery; it does not ask recipients to reject failing messages. Quarantine and reject policies introduce enforcement.

Move toward enforcement after identifying legitimate sources and checking alignment. A third-party service can pass its own authentication while failing alignment with your business domain.

A practical troubleshooting checklist

Collect an example: Record the sender, recipient, time and whether the message was rejected, quarantined or delivered to spam.

Map sending services: Include employee mail, website forms, CRM, invoices and campaigns.

Inspect received headers: Review SPF, DKIM and DMARC results alongside the envelope, signing and visible From domains.

Check DNS and signing: Confirm one valid SPF record and the correct Microsoft 365 DKIM configuration.

Review DMARC reports: Identify unknown sources and investigate legitimate senders failing alignment.

Test representative messages: Include third-party applications and any forwarding routes.

Document changes: Keep the previous configuration, change owner and test results so problems can be investigated quickly.

For a Chennai business using several cloud applications, this inventory is often more useful than repeatedly changing the email template.

Frequently asked questions

Will authentication guarantee inbox delivery?

No. Authentication helps validate domain use. Receiving systems apply additional filtering and reputation checks.

Is SPF alone enough?

No. It does not by itself establish alignment with the visible From address. Configure SPF, DKIM and DMARC together.

Can legitimate email fail after forwarding?

Yes. Forwarding can break SPF; a valid, aligned DKIM signature may still allow DMARC to pass if signed content remains intact.

Should we immediately set DMARC to reject?

Validate legitimate sources and reporting first, then introduce enforcement through a controlled rollout.

Where to start

Ask your IT team for a sending-source inventory and a sample authentication report. This provides a clear basis for deciding whether the issue is DNS configuration, third-party alignment or another delivery factor.

For help reviewing Microsoft 365 email authentication, contact Layots Technologies: info@layots.com | +91 99623 95939.