Your emails do not arrive
Quotes that “never reached me”, invoices in the junk folder, order notifications that bounce with a code. Without proper identification, the receiving mailbox has no reason to trust you.
SPF · DKIM · DMARC
Return to sender.
It is what Gmail and Outlook already do with mail that does not identify itself properly. And what they should do with anyone who writes using your domain. Check yours before somebody else does.
Fromfacturas@empresa.example
Toyour customer
- The senderSPF: In order
- The wax sealDKIM: Not visible from outside
- The standing orderDMARC: Missing
Return to sender
Sample envelope, with an invented domain.
The sorting office no longer lets just anything through
For years, unidentified mail got through all the same. Since 2024 the big mailbox providers have been closing the door, with dates and in writing.
Feb 2024: Google and Yahoo
They start to require senders to identify themselves: SPF or DKIM for everyone, and all three records for anyone sending in volume.
May 2025: Microsoft
Outlook.com asks for SPF, DKIM and DMARC from senders of more than 5,000 messages a day, and rejects with code 550 5.7.515 anyone who does not comply.
Nov 2025: Google
Gmail moves from deferring to rejecting: messages that do not comply begin to receive permanent rejections.
May 2026: IETF
DMARC is rewritten (RFC 9989). pct= disappears, the trick of applying the policy to “10%” of mail: the policy is now raised over time and with the reports in hand.
Three controls, in this order
Every email you send passes three questions before anyone reads it. They are three text records in your domain’s DNS.
1 · SPF
The sender
Who may write in your name.
A list, published by you, of the services allowed to send email with your domain: your company Gmail or Outlook, the invoicing program, the newsletter tool. There can be only one list, and it allows at most ten lookups: add one service too many and the whole thing breaks without warning.
2 · DKIM
The wax seal
That the letter arrives unopened.
A signature that each service puts on what it sends, with a key you publish in your DNS. It proves the message came from who it says and that nobody touched it on the way. It is the only one of the three that survives forwarding.
3 · DMARC
The standing order
What to do with letters that carry your name and are not yours.
Your instruction to the mailboxes: what to do when an email arrives with your domain that passes neither the sender check nor the wax seal. And where to send you, every day, the report of who has sent in your name.
Two problems fixed with the same sheet
Someone is writing in your name
An invoice with a different bank account number, sent “from” your domain to your customer. While your DMARC says p=none, mailboxes let it through: none means “just watch”.
With DMARC at quarantine or reject, whatever is not yours goes to spam or is returned. But you cannot raise it blindly: first you have to know, from the reports, that everything of yours passes.
Sealing: we set it up, from end to end
One payment per domain. You do not need to know what a TXT record is: we tell you what to paste and where, and we check that it has gone in properly.
Sealing
€129
+ VAT · one-off payment
Sender inventory
You tick which services send with your domain and we read what you already have published.
The record sheet
A single SPF with everything needed and within the ten lookups, the DKIM steps for each service and your DMARC.
The guide for your panel
With the name of each record written the way your DNS provider asks for it, and a version to forward to your IT person.
Automatic check
You press “Check” and we look at your DNS record by record. If something is not there, we tell you which one.
90 days of delivery receipts
We read the reports that Gmail, Outlook and the others send every day about your domain, and show them to you in plain language.
The step-up to quarantine and reject
When the reports say everything of yours passes, we give you the next record. Never before.
The sealing record
A document with what has been published and the date, for your files or for whoever asks for it.
€129 + VAT, one-off payment per domain. Each additional domain on the same order: €59.
The letter’s journey
Everything happens on the private page for your order and by email. No phone calls.
Questionnaire
5 minutes
You tick your email services and where you manage your DNS.
Record sheet
2 working days
The program generates it, a person reviews it and it reaches you ready to copy.
Paste and check
When you can
You or your IT person paste the records. A button tells you whether they are right.
Delivery receipts
14 days at the very least
The reports start to arrive. We see who sends with your domain and whether it passes.
Quarantine and reject
Two steps
With everything of yours in order, we raise the order: first to spam, then returned.
Sealed
Record
Your domain rejects what is not yours. You keep the record and the report of the 90 days.
What we do not do
We do not ask for passwords or access to your DNS
You paste the records yourself, or whoever looks after your domain does. We only read what is public.
We do not send email for you
No campaigns, no cold email, no domain “warm-up”. We get your identity in order; what you send is up to you.
We do not promise the inbox
That also depends on what you send and to whom. What we guarantee is the configuration, which can be checked from outside.
We do not scare you into buying
What cannot be known from outside shows in grey, not red. A diagnosis that accuses without evidence is not a diagnosis.
Questions
What is DMARC, in short?
A text record in your domain’s DNS that tells Gmail, Outlook and the others what to do with an email that carries your domain and fails the identity checks (SPF and DKIM): nothing (none), send it to spam (quarantine) or reject it (reject). And where to send you the daily report.
I already have DMARC with p=none. Is that not enough?
It is enough to meet the minimum that Google, Yahoo and Microsoft ask for. But none means “do nothing”: anyone who spoofs your domain still gets through. It is the first step, not the last. The real work is reaching quarantine and reject without losing your own mail, and for that you have to read the reports.
Can I break my email by touching this?
Yes, if it is done blindly: raising to reject with one of your services not aligned makes its emails get rejected. That is why Sealing starts at none, watches the reports for at least 14 days and only proposes a step up when your mail passes. And you approve the changes when you paste them.
I do not know what a DNS record is or where it gets pasted
You do not need to. The sheet brings each record with its copy button and the name written the way your provider asks for it, plus a version to forward to whoever looks after your website or domain. It is between three and six records.
Do I have to give you access to anything?
No. No passwords, no access to your domain panel, none to your email. The only thing that changes is that your DMARC sends us a copy of the aggregate reports, which carry neither the content nor the recipients of any message.
What happens when the 90 days are over?
Your configuration carries on working just the same: it is yours. What ends is our reading of the reports. If you want us to keep watching and warn you if something breaks, there is Watch: €49 + VAT a year per domain, in one payment. If not, we tell you which record to change so that the reports stop coming to us.
Does this make my emails reach the inbox?
It makes sure you are not rejected for failing to identify yourself and that nobody can pass themselves off as you. Reaching the inbox also depends on what you send and how people receive it. Anyone who promises you a delivery percentage is making it up.
What if I have several domains?
Each domain has its own sheet and its own reports. The first costs €129 + VAT and each additional one on the same order, €59 + VAT.
Start by looking
The X-ray is free and does not ask for your email. In twenty seconds you know what a mailbox sees when something from you arrives.