When this guide is useful
Businesses whose invoices, CRM messages, newsletters or transactional emails are being rejected or filtered
- Invoices arrive from office email but fail when sent through the CRM.
- A receiving system reports an authentication or domain-alignment failure.
- Different teams have independently added email services to the same domain.
- A new website, marketing tool or ticketing platform coincides with delivery problems.
Collect a failing example before changing DNS
Ask for the original message headers or non-delivery report, together with the sending time, recipient domain and service used. Compare a failing example with a successful message from the same workflow. Record whether mail is rejected during delivery, accepted into spam or never submitted by the application; those require different investigations.
Check the visible From domain, envelope sender and DKIM signing domain separately. Microsoft's DMARC documentation explains that a passing aligned SPF or DKIM result can satisfy DMARC. A service can authenticate its own domain successfully while still failing alignment with the brand address shown to the recipient.
Build a complete sender register
Include staff mailboxes, CRM, website forms, invoices, newsletters, helpdesk tools, monitoring alerts and any legacy equipment that sends messages. Give each sender a business owner and record the domains it uses. A DNS record copied from a supplier's example is not an inventory, and repeated amendments can leave obsolete senders authorised.
Where supported, configure the supplier's recommended custom-domain signing and return-path options. Keep the changes specific to the service and domain concerned. If a website form impersonates a visitor's address in From, use an authorised business sender with the visitor address in the appropriate reply field, then test the actual reply workflow.
Strengthen policy without disrupting legitimate mail
Review current DNS with the domain administrator and test the intended records before enforcement. Use reporting to identify known services and unexplained sources. Introduce stricter DMARC handling only when representative business flows have been checked, including forwarded mail, invoices, automated replies and messages from less frequently used applications.
Avoid solving authentication failures by broadly bypassing filtering or adding every unfamiliar source to an allow-list. Unknown sources may be spoofing attempts. Keep a change record containing the previous record value, the new value, approval, expected propagation period and the checks required before the change is considered complete.
Look beyond authentication to sender quality
Google's requirements for personal Gmail recipients include authentication, transport security and sender-quality requirements, with additional rules for higher-volume senders. Check the current requirements for your sending pattern. Use the provider's postmaster or reporting tools where available, and separate transactional failures from newsletter reputation problems.
Confirm that recipients expect the messages, that subscription choices are honoured and that suppressions are processed reliably. Measure the specific workflow: submitted, accepted, bounced and acted on where appropriate. Buying a new domain or changing provider without diagnosing complaints, invalid addresses or excessive volume can move the same problem into a new system.
From diagnosis to delivery
How Britixo can help
Britixo can review the path from your website, CRM or business application to the receiving mailbox, identify authentication mismatches and coordinate scoped DNS or application changes. We can help create a sender register, configure supported integrations and test the workflows that matter, rather than judging success from a single test email. Contact Britixo with the sending platform, affected domain and a summary of the error. Share original message evidence only through the agreed secure route. Recipient filtering decisions, platform restrictions and ongoing mailing practices remain factors outside any provider's direct control.
Talk through your requirementsCommon questions
Does passing DMARC guarantee that mail reaches the inbox?
No. It validates an aspect of sender identity. Recipient reputation systems, content, complaints, address quality and other policies still influence delivery.
Should we immediately switch DMARC to reject?
Only after identifying and testing legitimate senders. A strict policy applied before alignment is corrected can reject genuine invoices, CRM messages or other business mail.
Can we use one domain for every sending service?
Sometimes, but separate subdomains can make ownership and troubleshooting clearer. Assess branding, reply handling and operational responsibility before changing the domain structure.
Sources and further reading
Use the original documentation to check current product terms, eligibility and technical details.
Published by Britixo on 29 October 2026. How these guides are prepared. Product availability and delivery scope are confirmed for your requirements.