Short answer: MX routes incoming mail, SPF identifies permitted sending services, DKIM adds a verifiable signature, and DMARC sets a policy for messages that fail authentication and alignment with the visible From address. Together they form a sound business email configuration. They do not, on their own, guarantee inbox placement for every message.
Before editing anything, identify the authoritative DNS provider from your domain's nameservers. It may not be your registrar. Export or copy the existing records, choose your email provider, and collect its current configuration instructions. Never copy a DKIM key, MX destination or SPF value from another company's domain; these values depend on your provider and account.
Create the destination mailboxes first. Prepare employee accounts and shared addresses such as info and sales before changing MX. When moving providers, keep the previous service available during the transition and plan how to copy historical mail. An MX change routes new messages; it does not migrate old messages, contacts or calendars.
Configure MX using the exact hostnames and priorities supplied by your email provider. Lower numbers have higher priority. Review obsolete destinations before removing them. Do not combine unrelated providers as a backup arrangement without an agreed routing design. Changing MX does not require deleting the A or CNAME records that keep your website online.
Publish one SPF record at each relevant hostname. Inventory every service sending on your behalf: employee mail, invoices, store notifications and support software. Merge required include mechanisms into the existing SPF record rather than publishing several competing records. Check DNS lookup limits and your provider's instructions before applying the final configuration.
Generate DKIM in your provider's control panel. Publish the requested TXT or CNAME record at its specified selector, then enable signing. Different services can use different selectors on the same domain. Do not overwrite another service's key, and do not share private signing keys or mailbox passwords in public support conversations.
Introduce DMARC with monitoring before enforcement. Publish the policy under _dmarc, start with p=none where appropriate, and direct reports to an address you control. Review sending sources and alignment before using quarantine or reject. Enforcing a strict policy before authenticating store and billing messages can cause legitimate business mail to be rejected.
Test both directions. Send a message from the business mailbox to an external account, reply to it, and inspect the original message's authentication results. Check SPF, DKIM and DMARC, then test your website form and transactional messages separately. DNS caching and TTL mean changes may not appear everywhere immediately; repeated edits make troubleshooting harder.
For receiving failures, investigate MX, mailbox existence and storage. For sending failures, check SMTP settings, permissions and authentication results. For spam placement despite successful authentication, review sender reputation, message content and recipient consent. Consult Google's sender guidelines and Cloudflare's DNS record guide for technical reference.
Need this configured for your company? Share your domain, current mail provider and sending services through Namra Tech business email setup. Pricing depends on mailbox count, storage and the chosen service. If you need the domain first, see domain registration; if expiry is the problem, read our renewal and recovery guide.