This summer I audited my own email setup, the one I’d been running outbound campaigns through since February, and found the kind of thing that’s easy to spot in someone else’s setup and hard to see in your own. The subdomain carrying those campaigns had a DKIM key but no DMARC record. Separately, the marketing automation platform was delivering replies to its own built-in inbox, which is where it keeps them unless someone sets up forwarding, so six months of responses, including a CEO asking about fractional marketing leadership, sat somewhere I had no reason to look. Nothing failed loudly. Every dashboard showed emails going out, and none of them showed what happened after.
Small and mid-sized firms run into versions of this constantly, usually without knowing it, because email feels like plumbing someone set up years ago. The person who configured the domain has often moved on. An outside IT provider, if there is one, keeps the mailboxes working and tends to see deliverability as a marketing concern, while marketing assumes it’s an IT setting. Between them sit three DNS records that most people in the company have never heard of.
What the three records do
SPF lists the servers allowed to send mail for your domain. DKIM signs each message with a key published in DNS, so a receiving server can confirm the message came from someone holding that key and wasn’t altered on the way. DMARC tells receivers what to do when a message fails those checks, and asks them to send reports back about what they’re seeing. A DMARC policy of p=none asks for reports and nothing else; the current standard describes it as a monitoring mode that shouldn’t change how mail is handled (RFC 9989). It’s a sensible place to start and an easy place to stay indefinitely.
Why it stopped being optional
For years the large mailbox providers tolerated a great deal of unauthenticated mail. That changed in February 2024, when Google began requiring everyone sending to Gmail to use SPF or DKIM, and anyone sending more than 5,000 messages a day to have SPF, DKIM and a DMARC record, with the visible From domain aligned to one of them (Google). Yahoo published matching requirements at the same time (Yahoo). Microsoft followed for Outlook.com, Hotmail and Live addresses, enforcing its version for high-volume senders from May 2025 (Microsoft). In November 2025 Google said it was ramping up enforcement, including temporary and permanent rejections of non-compliant mail (Google). Mail that once would have gone to spam may now not arrive at all.
Adoption has moved less than those deadlines suggest. EasyDMARC, a vendor in this space, looked at 1.8 million domains belonging to large and fast-growing companies in 2025 and found that fewer than half had any DMARC record, and that most of the ones that did were set to monitoring only (EasyDMARC). Those are companies that generally have IT departments. I’d expect smaller firms to be further behind, though I haven’t seen a study that measures it.
Where marketing tools make it worse
Marketing is usually where the problem grows. Every platform that sends on the company’s behalf, whether a CRM, a newsletter tool or a sales sequencer, has to be authorized, and the usual way to authorize one is another include in the SPF record. SPF has a hard limit of ten DNS lookups, and a record that goes past it fails with an error rather than a warning (RFC 7208). My own record carries Microsoft 365, HubSpot and Brevo, which puts it somewhere between six and eight of those ten. A company that has added and abandoned a few tools over the years can cross the limit without anyone noticing, at which point SPF fails for everything it sends and DMARC depends entirely on DKIM being set up correctly for each sender. The abandoned entries carry a risk of their own, since each one still authorizes a vendor to send mail as the company.
Cold outbound sharpens all of it. Sequencing tools send volume from domains that get few replies at first, which is the pattern spam filters watch for, and many of them send from a subdomain they set up during onboarding. That subdomain needs its own DKIM key, and it’s common to find one that was configured halfway: the tool’s verification passed, mail flowed, and a record was never published. I had one of those too.
The question nobody’s assigned
None of this is hard once someone looks. Checking the records takes minutes with free tools, and most fixes are a few lines of DNS. What keeps the problem alive is ownership. The records live in a DNS account that IT controls, the sending tools belong to marketing and sales, and the cost shows up as replies that never come and leads that go quiet, which reads like a messaging problem. In my own case the DMARC gap turned out to be the smaller issue. The larger one had nothing to do with DNS: a routing setting nobody had revisited since the platform was set up, which quietly decided whether a reply ever reached a person.
I now treat this as part of any diagnostic, because the symptoms of a deliverability problem look so much like the symptoms of weak marketing: lower response, a quieter pipeline, a sense that the market has cooled. It raises an uncomfortable question about how many campaigns have been judged on results their recipients never had a chance to see.