CentriWebDMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells Gmail, Yahoo, Outlook and other mail services what to do with email that claims to come from your domain but fails authentication, and asks them to send you reports about it. It works with two other records: SPF, which lists the servers allowed to send for your domain, and DKIM, which signs each message so receivers can check it really came from you.
When quotes and invoices land in a customer’s spam folder, one of these three is usually missing or misconfigured for the tool that sent them. Below is what each does, what Google and Yahoo now require, and how to read and tighten DMARC without stopping your own email.
Why invoices land in spam
Your invoices probably aren’t sent by your mailbox provider. They’re sent by your accounting or invoicing software, using your address in the From line. The same goes for your CRM, booking system, website forms and newsletter tool.
To the receiving mail service, a message from accounts@yourbusiness.com sent by a server it doesn’t recognise looks the same as a scammer using your address. SPF, DKIM and DMARC are how you tell it which senders are genuinely yours. If a tool isn’t covered, its messages are more likely to be filtered or rejected.
For a trades business, that can mean a customer who never saw the invoice, a payment that arrives weeks late, and a reminder sequence that keeps landing in the same junk folder. Our guide to invoice reminder automation only works if the first email arrives.
SPF, DKIM and DMARC: what each one does
SPF: who may send
SPF (Sender Policy Framework) is a single TXT record listing the servers allowed to send email for your domain. The standard, RFC 7208, says a domain must not have multiple SPF records, and limits the DNS lookups an SPF check may make to 10. Exceed it and the check returns a permanent error.
DKIM: a signature on each message
DKIM (DomainKeys Identified Mail), defined in RFC 6376, lets the domain that signs a message take responsibility for it. The sending tool signs with a private key, and you publish the matching public key in your DNS under a selector, such as selector1._domainkey.yourbusiness.com. The standard says a failed signature does not by itself force rejection, which is why DMARC exists.
DMARC: the policy and the reports
DMARC is now RFC 9989, published in May 2026 as a Proposed Standard, replacing the older RFC 7489. It lets a domain owner have its use of the domain validated, state what receivers should do with mail that fails, and request reports. The record sits at _dmarc.yourbusiness.com.
What Google and Yahoo require from senders
Google’s email sender guidelines say that starting February 1, 2024, everyone sending to Gmail accounts must:
- set up SPF or DKIM for their sending domains
- have valid forward and reverse DNS records for sending domains or IPs
- use a TLS connection to send
- keep spam rates reported in Postmaster Tools below 0.3%
- format messages to the internet message standard, RFC 5322
Senders of more than 5,000 messages a day to Gmail must also set up SPF and DKIM and publish DMARC (a policy of none is acceptable), align the From domain with either the SPF or DKIM domain, and support one-click unsubscribe on marketing messages. Google recommends keeping spam rates below 0.10% and never reaching 0.30%.
Yahoo’s sender requirements are similar. All senders need SPF or DKIM at a minimum, a spam rate below 0.3%, valid forward and reverse DNS, and compliance with RFCs 5321 and 5322. Bulk senders need both SPF and DKIM, a DMARC policy of at least p=none that passes, a From domain aligned with the SPF or DKIM domain (relaxed alignment is acceptable), one-click unsubscribe, and must honour unsubscribes within 2 days. Yahoo says enforcement began in February 2024.
Most small businesses never send 5,000 emails a day. Meeting the bulk rules anyway costs nothing and removes guesswork, and other mailbox providers have their own rules, so aim for the stricter standard.
What a DMARC record looks like
A starting record, published as a TXT record at _dmarc.yourbusiness.com, looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com
| Tag | What it means |
|---|---|
| v | Version. Must come first and be DMARC1 |
| p | Policy for mail that fails: none, quarantine or reject |
| rua | Where to send aggregate reports |
| ruf | Where to send failure reports for individual messages |
| sp and np | Policies for subdomains, and for subdomains that don’t exist |
| adkim and aspf | Whether DKIM and SPF alignment is relaxed or strict |
| t | Test mode: asks receivers not to apply the policy as written |
RFC 9989 defines the three policies. At none, the domain owner expresses no preference. At quarantine, it considers failing mail suspicious. At reject, it treats a failure as a clear sign the use of the domain is not valid. The 2026 standard also retires the older pct tag, which let owners apply a policy to a share of their mail; the t tag takes over its testing role.
Alignment: where invoicing tools usually fail DMARC
DMARC passes only when SPF or DKIM passes for the same domain as the From address. That match is called alignment.
Many sending tools pass SPF for their own domain, not yours, because they use their own address behind the scenes for bounces. SPF passes, but it isn’t aligned, so DMARC looks to DKIM. If the tool signs with its own domain too, DMARC fails, even though everything looks set up.
The fix is nearly always the same: find the “custom domain” or “domain authentication” setting in each tool, add the DKIM records it gives you, and verify them. Then the tool signs as your domain and DMARC passes on DKIM alone.
Checking your own domain in ten minutes
- Send an invoice from your accounting software to a personal Gmail address you control.
- Open it, choose the three-dot menu and then Show original. Gmail lists SPF, DKIM and DMARC as PASS or FAIL.
- Repeat for your CRM, website contact form, booking system and newsletter tool.
- Look up the TXT record at _dmarc.yourbusiness.com with any DNS lookup tool. No record means no DMARC.
Any tool showing DMARC FAIL is the one to fix first, usually by turning on its DKIM setting.
Reading DMARC reports
Aggregate reports arrive as machine-readable files from the mail services that receive your mail. Each one lists which servers sent as your domain and whether they passed SPF, DKIM and alignment. They are hard to read raw, so most people send them to a report-reading service or ask whoever manages their DNS for a summary.
What to look for in the first few weeks:
- tools you recognise that fail alignment (fix their DKIM)
- tools you had forgotten about, such as an old newsletter account
- servers you don’t recognise at all, which may be someone faking your domain
Moving DMARC from none to quarantine to reject
Publishing p=none changes nothing about delivery; it only starts the reports. dmarc.org’s overview describes the usual path: start at none while you fix your mail streams, then move to quarantine, then reject as you gain confidence.
- Publish p=none with a reporting address.
- Fix every legitimate sender until reports show it passing.
- Move to p=quarantine and watch for a few weeks.
- Move to p=reject once nothing legitimate fails.
Jumping straight to reject is the classic mistake: it blocks every tool you forgot, including the one that sends your invoices. One more trap: Google tells senders not to impersonate Gmail From: headers and says Gmail will begin using a DMARC quarantine enforcement policy, so don’t set any tool to send as a gmail.com address.
The step-by-step fixes, including merging SPF records and website form email, are in our guide to business emails going to spam. If you are also choosing a mailbox provider, see Google Workspace vs Microsoft 365. Setting up and watching these records is part of our managed hosting and email work, for businesses that would rather not touch DNS.