To set up business email on your own domain properly, you need three DNS records next to your mailbox provider’s MX records: SPF (which servers may send for your domain), DKIM (a signature that proves the message was not changed) and DMARC (what receivers should do when the first two fail). Without them, your quotes and invoices are more likely to land in spam, and anyone can send mail that looks like it came from you.

This guide walks through what each record does, the order to add them in, and the places UAE businesses usually get it wrong, such as website contact forms and invoicing tools that send “from” your domain without being listed.

Why the domain matters before the mailbox

A free webmail address works for personal use, but customers in Dubai or Abu Dhabi expect a quote to come from sales@yourcompany.ae or .com, not a personal inbox. Using your own domain also means the address stays with the company when staff change. If you have not registered the domain yet, our guide to .ae domain registration covers who can register one and what you need.

Once you own the domain, you choose a mailbox provider (for example Google Workspace or Microsoft 365, or the email included with your hosting). The provider gives you MX records that tell the world where to deliver incoming mail. SPF, DKIM and DMARC are about outgoing mail: they let receiving servers check that a message claiming to be from your domain really is.

What SPF, DKIM and DMARC each do

Gmail now expects these records. Google’s email sender guidelines say every sender to Gmail accounts must set up SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC. Most small businesses send far less than that, but having all three is still the safe default, because other mail providers apply similar checks.

How to set it up, step by step

Step 1: list everything that sends email as your domain

Before touching DNS, write down every system that sends mail with your domain in the “From” address. For a typical UAE SME this list is longer than expected:

• Your mailbox provider (staff email)
• The website: contact forms, WooCommerce or Shopify order emails, password resets
• Accounting or invoicing software that emails tax invoices to customers
• A newsletter or marketing tool
• A CRM, helpdesk or booking system (common for clinics and real-estate brokers)

Each of these needs to be covered by SPF, signed with DKIM for your domain, or switched to send through your main mailbox. Anything left off the list is what starts failing when you later tighten DMARC.

Step 2: add one SPF record

SPF is a single TXT record on your domain. A domain that only sends through Google Workspace uses the record Google gives in its SPF setup guide: v=spf1 include:_spf.google.com ~all. Microsoft 365 and other providers publish their own include: value.

Rules that save a lot of trouble:

• Only one SPF record per domain. If you add a second service, add its include: to the existing record instead of creating another TXT record that starts with v=spf1. Two SPF records break both.
• Keep the include count low. Google’s guide notes an SPF record can have up to 10 include: tags. Every extra marketing or CRM tool adds lookups, so remove services you no longer use.
• End with ~all to start. Google recommends ~all, which asks receivers to treat mail from unlisted servers as suspicious rather than reject it outright.

Step 3: turn on DKIM signing

DKIM is switched on inside your mailbox provider’s admin panel, not just in DNS. The usual flow is:

1. In the admin console, open the email authentication or DKIM settings and generate a key.
2. Copy the record it gives you (a TXT record with a long public key, or one or two CNAME records).
3. Add it in your DNS at the exact host name shown, for example google._domainkey or selector1._domainkey.
4. Go back to the admin console and click to start signing. Many people add the record and forget this last step.

Repeat this for every other service that sends as your domain and supports DKIM. Newsletter tools, helpdesks and transactional email services almost always offer a “verify your domain” or “authenticate your domain” screen with their own DKIM records. Use it; without it, they sign with their own domain and your DMARC check will not line up.

Step 4: publish DMARC, starting with monitoring

DMARC goes on a TXT record at _dmarc.yourdomain.com. Google’s DMARC setup guide recommends three things worth following:

• Wait 48 hours after setting up SPF and DKIM before adding DMARC.
• Start with the policy set to p=none, which only monitors and does not block anything.
• Include a rua address so you receive aggregate reports. Google warns this can mean a high volume of report emails, so use a separate mailbox or a reporting service rather than your main inbox.

A starting record looks like this: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com. Read the reports for a few weeks. They show which servers are sending as your domain and whether each passes. When everything legitimate passes, move the policy to p=quarantine, and later to p=reject if you want spoofed mail blocked outright.

For DMARC to pass, the domain in the “From” address has to match the domain checked by SPF or the domain that signed with DKIM. This is called alignment, and it is the reason a tool that sends “from” your domain but signs with its own domain still fails.

The website problem: contact forms and order emails

This is where most of the issues we see on UAE business sites come from. A WordPress site, by default, sends form notifications and WooCommerce order emails from the web server itself. That server is usually not in your SPF record and does not sign with your DKIM key, so those emails go to spam or never arrive, and the business owner assumes the form is broken.

The fix is to send website mail through an authenticated service instead of the server’s built-in mail function. On WordPress that means an SMTP plugin connected to your mailbox provider or to a transactional email service that you have added to SPF and set up with DKIM. On Shopify, the store’s sender email settings include a domain authentication step that adds the DNS records for you. After the change, send a test from the form and check the message headers for spf=pass, dkim=pass and dmarc=pass.

If your website was built or hosted by someone else, check who controls the DNS before you start. Our web development service covers this kind of setup as part of a build or a rescue. If you are changing host as well, see our guide on how to move a website to new hosting without downtime.

Common mistakes to check for

• Two SPF records, often one left by an old hosting company and one added for the new mailbox provider.
• DKIM record added in DNS but signing never switched on in the provider’s admin panel.
• DMARC set straight to p=reject, which blocks invoices from an accounting tool nobody remembered.
• DNS edited at the wrong place. If the domain’s nameservers point to a CDN or your host, records added at the registrar do nothing.
• Forgetting that DNS changes can take time to spread before they show up in checks.

Frequently asked questions

Do I need SPF, DKIM and DMARC if I only send a few emails a day?

Yes. Google’s guidelines require at least SPF or DKIM for every sender to Gmail, and having all three makes it much harder for someone to send fake emails that look like they came from your company.

Can I use a .ae domain for business email?

Yes. SPF, DKIM and DMARC work the same way on a .ae domain as on a .com. You add the records in whichever DNS service the domain’s nameservers point to.

What happens if I set DMARC to reject too early?

Receiving servers may reject genuine mail from any service that is not yet covered by SPF or DKIM, such as an invoicing tool or website form. That is why Google recommends starting with p=none and reading the reports first.

How do I check whether my records are working?

Send an email to a Gmail address, open it, choose “Show original”, and look for pass results for SPF, DKIM and DMARC. Your DMARC aggregate reports will show the same for all mail sent as your domain.

If you want us to check your domain’s email records or fix website emails that land in spam, send a short brief through our contact page and we will reply with a fixed quote.