If your business emails keep landing in spam, or a client tells you they received a strange message that looked like it came from you, the problem is often missing email authentication. SPF, DKIM and DMARC records are three small pieces of text added to your domain's DNS settings. Together they tell the world which servers are allowed to send email for your domain and what to do with messages that fail the check. This guide explains each record in simple terms, shows real examples, and walks you through setting them up for a domain like yourcompany.co.ug.
Why email authentication matters for Ugandan businesses
Email was designed decades ago without any built in way to prove who sent a message. Anyone can type your address into the "From" line of an email. Criminals use this to send fake invoices, fake payment requests and fake job offers that appear to come from real companies. Big mail services such as Gmail, Outlook and Yahoo now look closely at authentication records, and messages from domains without them are far more likely to be marked as spam or rejected.
For a business, that means two risks: your genuine quotations and invoices do not reach clients, and fraudsters can impersonate you. Setting up SPF, DKIM and DMARC is one of the cheapest and most effective fixes.
What is an SPF record?
SPF stands for Sender Policy Framework. It is a TXT record on your domain that lists the mail servers allowed to send email on your behalf. When a receiving server gets a message claiming to be from you, it checks your SPF record to see whether the sending server is on the list.
A simple SPF record looks like this:
v=spf1 include:_spf.yourmailprovider.com ~all
- v=spf1 says this is an SPF record.
- include: adds the servers of your email provider.
- ~all means "treat anything else with suspicion". A stricter version, -all, means "reject anything else".
Common SPF mistakes:
- Having two SPF records. You must have only one; combine all senders into it.
- Forgetting a service. If your website contact form, accounting software or bulk email tool sends mail as your domain, it must be included.
- Too many lookups. SPF allows a maximum of ten DNS lookups; long chains of includes can break it.
What is a DKIM record?
DKIM stands for DomainKeys Identified Mail. It adds a digital signature to every email you send. Your mail server signs each message with a private key, and you publish the matching public key in your DNS. The receiving server uses that public key to confirm two things: the message really came from a server you control, and it was not altered on the way.
A DKIM record is a TXT record with a name like default._domainkey.yourcompany.co.ug and a long value beginning with v=DKIM1; k=rsa; p= followed by the key. You do not write this key yourself. Your email or hosting provider generates it, and you copy it into DNS. On cPanel hosting it is often created automatically in the Email Deliverability section.
What is a DMARC record?
DMARC stands for Domain based Message Authentication, Reporting and Conformance. It sits on top of SPF and DKIM and tells receiving servers what to do if a message fails those checks. It also lets you receive reports showing who is sending email using your domain.
A starter DMARC record is a TXT record named _dmarc.yourcompany.co.ug with a value like:
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.co.ug
The key part is the policy, p=:
- p=none: monitor only. Nothing is blocked, but you receive reports.
- p=quarantine: failing messages go to spam.
- p=reject: failing messages are refused outright.
The safe path is to start with none, read the reports for a few weeks to confirm all your genuine senders pass, then move to quarantine and eventually reject.
How the three work together
Think of it like a delivery to a secure office in Nakasero. SPF is the guest list at the gate: is this vehicle allowed to deliver for this company? DKIM is the sealed, signed envelope: was the parcel tampered with? DMARC is the instruction to the guard: if a delivery fails the checks, turn it away, keep it aside, or just note it in the book. Each one helps on its own, but together they give strong protection.
How to set up SPF, DKIM and DMARC step by step
- Find out who sends your email. List your email host, website, newsletter tool, CRM and any software that sends invoices or alerts.
- Log in to your DNS manager. This is usually your hosting control panel or your domain registrar's dashboard.
- Create or update the SPF record. Make one TXT record at the root of your domain that includes every sender.
- Enable DKIM. Generate the key in your email provider or cPanel and publish the TXT record exactly as given.
- Add a DMARC record with p=none and a reporting address.
- Wait for DNS to update. Changes often take effect within minutes to a few hours, though they can take longer.
- Test. Send an email to a Gmail account, open it, choose "Show original" and look for PASS next to SPF, DKIM and DMARC.
- Tighten DMARC after a few weeks of clean reports.
Reading DMARC reports
DMARC reports arrive as compressed XML files, which are hard to read by eye. Free online DMARC report viewers can turn them into simple tables showing which servers sent mail as your domain and whether they passed. Look for any unknown sender: it is either a service you forgot to include in SPF, or someone trying to impersonate you.
Frequently asked questions
Do I need all three records?
Yes, ideally. Major mailbox providers increasingly expect SPF and DKIM, and DMARC is what ties them together and protects your domain from spoofing.
Will these records stop all spam?
No. They stop others from pretending to be your domain and help your genuine mail get delivered. They do not filter spam you receive; that is your mail server's job.
Can a wrong record stop my email?
A badly written record, or jumping straight to p=reject before checking all your senders, can cause genuine mail to be blocked. Go step by step and test.
I use a free Gmail address. Can I add these?
No. These records live on your own domain. You need a business email address on a domain you own to control them.
Conclusion
SPF, DKIM and DMARC records sound technical, but they are simply three lines of text that prove your emails are real. Adding them improves delivery, protects your brand and makes life harder for scammers. If your business email is hosted with Baasa Cloud, our support team can check and set up these records for you, so your invoices and quotations land where they should.