The problem is not only the spam folder

When DNS email records are not clean, the result is weaker delivery and a higher risk that someone sends fake messages on behalf of the company.

That is why email security is not separate from the domain. DNS, the mail provider, invoice-sending applications and mailing tools must be aligned.

The roles of SPF, DKIM and DMARC

SPF publishes which servers may send mail for a domain. DKIM adds a cryptographic signature to the message. DMARC checks alignment and tells receivers what to do with messages that fail.

The safest approach is gradual: inventory first, then p=none monitoring, and only then stricter policies once legitimate senders pass authentication.

  • Inventory of all systems that send email
  • One clean SPF record without conflict
  • DKIM for every legitimate provider
  • DMARC reports before strict policy

Common mistakes

Common mistakes include multiple SPF TXT records for the same domain, forgotten old tools, DKIM that was never activated and DMARC set to reject immediately without testing.

The second problem is ownership: nobody knows who controls DNS, who has provider access and which applications send on behalf of the domain.

How we clean up email

We start with DNS inventory and mail-flow review. Then we clean SPF, enable DKIM where possible, introduce DMARC monitoring and watch who sends mail.

When reports show that legitimate messages pass, policy can gradually move toward quarantine and reject.