Documentation 19.0

Understand how WindoorERP sends and receives email

Publish DNS records so your email is trusted

3 min read Updated 2026-08-14 WindoorERP 19.0

What this does

SPF, DKIM and DMARC are three DNS records that prove your emails really come from your domain. Without them, a large share of what WindoorERP sends is filed as spam or dropped.

Before you start

  • You need access to the DNS zone of your domain — usually at your registrar or DNS host.
  • Get the exact values from whoever sends your mail: your SMTP provider publishes them, and they differ per provider.
  • Changes to DNS take minutes to hours to propagate. Plan for the wait instead of re-editing the record.

SPF — who may send

SPF lists the servers allowed to send email for your domain. The receiving server compares the sending IP against that list. In WindoorERP the check applies to the bounce address, built from the Alias Domain in your general settings — so it is the alias domain that must be SPF-compliant.

  1. 01
    Look up the SPF value your mail provider tells you to include — it looks like include:spf.example-provider.com.
  2. 02
    If the domain has no SPF record yet, create a TXT record with the value v=spf1 include:spf.example-provider.com ~all.
  3. 03
    If it already has one, edit it — a domain may only have one SPF record. Add the include next to the existing ones: v=spf1 include:spf.example-provider.com include:_spf.google.com ~all.
  4. 04
    Check the result with a tool such as MXToolbox's SPF Record Check.

DKIM — nothing was tampered with

DKIM signs each message. The receiving server fetches your public key from DNS and verifies the signature, which proves the message is yours and was not altered on the way.

  1. Get the selector and key from your mail provider. It is usually a CNAME to publish, sometimes a TXT record containing the key itself.
  2. Create it in your DNS zone exactly as given — selector names are case-sensitive and must match what the sender signs with.
  3. Verify with a DKIM lookup tool, entering yourdomain.com:selector.

DMARC — what to do when a check fails

DMARC ties the other two together and tells receiving servers what to do with mail that fails them. There are three policies:

  • p=none — do nothing, just report. Start here.
  • p=quarantine — treat failures as suspicious.
  • p=reject — refuse them outright.

For DMARC to pass, SPF or DKIM must pass and the domains must align. A record such as _dmarc IN TXT "v=DMARC1; p=none; rua=mailto:postmaster@example.com" sends you aggregate reports without affecting delivery — the safe way to see who is sending as you before tightening the policy.

Test the whole thing

Send one real email from your database to a tool such as Mail-Tester. It scores the content and every authentication record in one go, which is faster than checking each record separately and guessing about the rest.

Common mistakes

  • Creating a second SPF record instead of editing the first. Two SPF records mean no valid SPF at all.
  • Publishing records for one provider while sending through another — the records must describe whoever actually sends.
  • Jumping straight to p=reject and silently killing legitimate mail from a system nobody remembered.
  • Assuming a passing check guarantees the inbox. Spam filters weigh content and reputation too.

Continue learning

Receive incoming email in the database An inbound message is any email delivered to your database: someone writing to a…

Was this article helpful?

Running a window or door factory?

Ask for a demo