The three DNS records that stop your email landing in spam, and how to set them up for your domain.
SPF, DKIM and DMARC are DNS records that prove email from your domain is genuine. Mail providers such as Gmail and Outlook check them, and messages from domains without them are much more likely to end up in spam.
SPF: who may send email for your domain
SPF is a TXT record on your domain that lists the servers allowed to send your email. If you only send email through your Twerple mailboxes, this is a good record:
Type: TXT Name: @ Value: v=spf1 a mx ~all
If you also send through other services, add them to the same record, for example a newsletter tool or Google Workspace. The service's help pages give you the part to add, which starts with include::
v=spf1 a mx include:_spf.google.com ~all
Your domain must have only one SPF record.
DKIM: a signature on every message
DKIM adds a digital signature to your outgoing email, which the receiving server checks against a key published in your DNS. Email sent from your Twerple mailboxes and webmail is signed automatically.
To check that the key is published, open Domains → DNS Zones in HostPanel and look for a TXT record whose name ends in ._domainkey. If your domain uses another company's nameservers, or you cannot find the record, open a support ticket and we will send you the exact record to add.
DMARC: what to do with failures
DMARC tells receiving servers what to do with email that fails SPF and DKIM, and where to send reports. Start with a record that only monitors:
Type: TXT Name: _dmarc Value: v=DMARC1; p=none; rua=mailto:you@example.com
Replace the address with one where you want to receive the reports. Once you are confident all your genuine email passes, change p=none to p=quarantine, and later to p=reject.
Checking your records
Send a message from your mailbox to a Gmail address, open it, and choose Show original. Gmail shows whether SPF, DKIM and DMARC passed.