Email for Your Domain: Hosting Options and SPF, DKIM and DMARC Setup
Your options for email on your own domain, and how to set up SPF, DKIM and DMARC so your messages reach inboxes instead of spam folders.
An address like info@yourcompany.com looks more trustworthy than a free webmail address, and it stays yours if you change providers. But domain email has become stricter: large mailbox providers now expect senders to prove they are allowed to send for the domain. This guide covers where to host your email and the three DNS records that decide whether your messages are delivered.
- You can host email with your web host, with a dedicated business email service, or send website mail through a transactional email service.
- SPF, DKIM and DMARC are DNS records that let receiving servers verify mail from your domain.
- Large mailbox providers require these records for bulk senders, and they help every sender’s delivery.
Where to host your domain email
| Option | Good for | Watch out for |
|---|---|---|
| Mailboxes included with web hosting | Small teams, low cost | Storage limits, spam filtering quality, shared IP reputation |
| Dedicated business email service | Businesses that rely on email | Per-user monthly cost |
| Transactional email service | Website messages: orders, password resets, forms | Not for personal mailboxes |
A common setup is a dedicated email service for staff mailboxes and a transactional service for messages sent by the website. Avoid relying on the web server’s default PHP mail function for important messages; it often lands in spam.
MX records: receiving email
MX records tell other servers where to deliver mail for your domain. Your email provider gives you the values. Only one provider should normally receive mail for a domain, so remove old MX records when you switch.
SPF: who may send for your domain
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail using your domain. An example:
v=spf1 include:_spf.example-mail.com include:mailer.example.net ~all
- Have only one SPF record per domain. Combine all senders into it.
- Include every service that sends as your domain: your mailbox provider, your website’s mail service, your newsletter or CRM tool.
- SPF is limited to ten DNS lookups; too many
includeentries make it fail. ~all(soft fail) is a common, cautious ending;-all(fail) is stricter.
DKIM: a signature on every message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The sending service holds a private key, and you publish the matching public key in DNS, usually as a TXT or CNAME record at a name like selector._domainkey.example.com. Receiving servers check that the message was signed by your domain and was not altered.
Each service that sends for you should have its own DKIM record. Your provider’s dashboard shows the exact values and confirms when they are working.
DMARC: the policy and the reports
DMARC ties SPF and DKIM to the address people see in the “From” line and tells receivers what to do when a message fails. It is a TXT record at _dmarc.example.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
- Start with
p=noneto monitor without affecting delivery. Receivers send you aggregate reports showing who is sending mail as your domain. - Fix any legitimate senders that fail, by adding them to SPF or setting up their DKIM.
- Move to
p=quarantine, which sends failing messages to spam, and later top=reject, which blocks them. This protects your domain from being used in phishing.
DMARC reports are XML files; a free or paid DMARC report tool makes them readable.
Other delivery tips
- Send newsletters only to people who opted in, and include a clear unsubscribe link.
- Keep complaint rates low; mailbox providers watch how many recipients mark your mail as spam.
- Use a consistent “From” address and name.
- Make sure the sending server’s IP has a reverse DNS (PTR) record if you run your own mail server.
Frequently asked questions
Why do my website’s emails go to spam?
Usually because they are sent from the web server without SPF, DKIM and DMARC alignment. Route them through a transactional email service and add its records.
Can I have two SPF records?
No. Two SPF records make SPF fail. Merge them into one record.
Will DMARC break my email?
Not with p=none, which only collects reports. Tighten the policy only after the reports show your real senders pass.
