Email Deliverability Fix: SPF, DKIM and DMARC for a Postfix Server

The problem

A production mail server running Postfix was sending messages that went straight to the spam folder at the three largest mailbox providers: Gmail, Outlook and Yahoo. For an e-commerce business that meant order confirmations and customer replies were not being seen.

Mailbox providers decide where a message lands by checking whether the sending server is authorised for the domain (SPF), whether the message is signed by the domain (DKIM), what the domain asks receivers to do when those checks fail (DMARC), and whether the sending IP resolves back to a matching hostname (reverse DNS). A gap in any of these is enough to push mail into spam.

What I did

• Audited the domain's DNS and found a misconfigured SPF record that did not correctly authorise the sending server.
• Corrected the SPF record so the server's IP was explicitly authorised.
• Generated DKIM keys, published them in DNS under proper selectors and configured Postfix to sign outgoing mail.
• Published a DMARC policy so receivers know how to treat unauthenticated mail claiming to be from the domain.
• Configured reverse DNS (PTR) so the sending IP resolves to the mail server's hostname.

Result

Deliverability was restored within 4 hours of starting work. In a separate engagement, a full migration from shared hosting to a dedicated Postfix server with SPF, DKIM and DMARC took inbox placement from 40% to 98%.

“Irfan fixed our entire mail server setup in under 4 hours. We were sending to spam folders for days — he resolved it completely. Could not believe it.”

— Silke G., e-commerce business owner (Fiverr)