Four short lines of text, sitting in a place most business owners have never logged into, decide whether your company can send and receive email. They are DNS records, and DNS is basically the internet’s phone book. Your domain name is the listing. The records are the details underneath it.
We are using a post office analogy for the whole post, because it holds up remarkably well. Your domain is your business address. The post office needs to know where to deliver your mail, which carriers are allowed to drop off mail in your name, how to tell a real envelope from a forged one, and what to do with the fakes. That is exactly what these four records handle.
The Four Records, One Sentence Each
- MX tells the world where to deliver your mail. It is the address on file at the post office, and Microsoft’s setup documentation puts the consequence plainly: when you update your domain’s MX record, all new email for anyone using your domain goes to the new destination.
- SPF lists who is allowed to send mail as you. Microsoft describes it as a text record in DNS used to identify valid sources of mail for your domain, and to say what a receiving server should do with mail from a source you never listed. It is the list of approved carriers at the front desk.
- DKIM proves the message was not tampered with. Microsoft describes DKIM as using your domain to digitally sign important elements of the message, including the From address, and storing that signature in the message header so the receiving server can verify nothing was altered. It is a tamper evident seal on the envelope.
- DMARC says what to do when the first two fail. Microsoft describes DMARC as using SPF and DKIM to check that the domains in the message actually line up, specifying the action the receiving system should take on failures, and identifying where to send the results. It is your standing instruction to every mailroom in the world, plus a request for a report.
These exist because forged email is cheap and effective. Microsoft’s documentation, as we read it in 2026, describes email authentication as a group of standards built to identify and prevent messages from forged senders, and notes that spoofed senders are commonly used in business email compromise and phishing. We covered why that particular attack keeps working in our post on the surge in phishing attacks.
What Breaks When One Is Wrong
Each record fails in its own way, which is useful, because the symptom tells you where to look.
- Wrong MX means no mail arrives. This is the loud failure. Nobody can reach you, and senders may get bounce messages. Microsoft’s documentation warns that an old record from a previous provider needs to be removed, or set to a lower priority than the new one, or delivery goes to the wrong place.
- Wrong SPF means your legitimate mail looks fake. If your invoicing system or marketing platform is not listed, receiving servers see mail from an unlisted source. Microsoft notes that many companies never publish SPF records at all because they do not know every service sending on their behalf.
- Missing DKIM removes your safety net. Microsoft points out that DKIM can validate messages that fail SPF, because forwarding does not disturb the signature the way it disturbs SPF. Without DKIM, forwarded mail is far more fragile.
- Aggressive DMARC deletes your own mail. If you tell the world to reject anything that fails, and one of your services fails, that mail is gone silently. This is why DMARC is rolled out gradually, watching the reports before tightening the instruction.
One honest complication worth knowing: Microsoft notes that legitimate services which modify messages in transit can break SPF, DKIM, and therefore DMARC. Mailing lists and some forwarding setups do exactly that. It is not always your configuration.
Why New Services Keep Touching These Records
Here is the pattern behind most email surprises. Every time you add a service that sends email as your company, that service becomes a new carrier dropping off mail in your name. The post office has never heard of them.
Think about how many of these a normal business collects: the newsletter platform, the appointment reminder tool, the invoicing system, the applicant tracking system, the survey tool somebody signed up for last spring. Each one usually asks you to add or update a record so its mail is trusted. Microsoft’s guidance for bulk senders is to verify that the domain shown in the From address matches the domain that passes authentication.
This is why “we just signed up, why is nobody getting our emails” is such a common question. Nothing broke. A new carrier showed up without paperwork.
How to Check Your Own Domain Today
You can look at your own records in about five minutes, and you should, because you are the one who signs the vendor contracts.
- Find out who hosts your DNS. It might be your domain registrar, your web host, or your IT provider. Whoever it is, that control panel is the source of truth, not a spreadsheet from three years ago.
- Look up the records themselves. Windows includes a tool called nslookup and Mac and Linux include one called dig. There are also free web based lookup tools. Ask for the MX record and the text records for your domain.
- Read the SPF line out loud. It is one text record listing sending sources. If you see a service you stopped using two years ago, that is a cleanup item.
- Check whether DMARC exists at all. Many small businesses have none. If yours exists, note whether it is set to monitor only or to actually reject failures, and whether reports are going to an address somebody reads.
If this feels foreign, that is fine. The point is not to become a DNS administrator. It is to know these records exist and to notice when a vendor asks you to change one.
Write It Down, Then Change It On Purpose
Keep a simple document listing every DNS record for your domain, what it is for, which vendor asked for it, and when it was added. One page. Boring. It has saved more afternoons than any tool we own.
Then build the habit around changes. Before anyone edits a record, write down what it says now. Make one change at a time, not four. Do it Tuesday morning, never at 4:30 on a Friday, because these changes take time to spread across the internet and you want people awake when they do. Then verify that mail is flowing, inbound and outbound, including from the systems that send automatically.
Lock down who can make these edits, too. Access to your DNS is access to your email, your website, and your identity as a business. That belongs on the short list of accounts with strong protection, alongside the other essentials we described in why cybersecurity is no longer optional for mid-sized businesses.
The Bottom Line
MX decides where your mail lands. SPF says who may send as you. DKIM proves the message was not altered. DMARC tells the world what to do with the ones that fail. Every new service you sign up for touches one of them, and a careless edit can take email offline for an afternoon. You do not need to memorize the syntax. You need a documented list, one person responsible, and the habit of changing these records deliberately.
If nobody at your company can say for certain what your DNS records look like or who can change them, that is worth fixing before it becomes an emergency. We can document them, clean up the leftovers, and set up email authentication properly. Contact us today.
Sources:
Comments are closed