Your site is on .ca, your email on .com: check both domains
Mail servers judge the domain in your email address, not your website's. Why businesses with two domains often protect the wrong one, and how to fix it.
By Youssef Bitar · · 3 min read · Lire cet article en français
On this page
Last week, a marketing agency in Québec replied to one of our emails with a single line: “Our email runs on the .com, not the .ca.”
They were right, and it was our mistake. We had checked the email records of the domain their website uses, a .ca, and flagged a missing DMARC record there. Their email goes out from a .com. We checked again, on the right domain this time. The .com was missing DMARC too, so the advice still stood, but the lesson was worth more than the finding: plenty of businesses own two domains, and it is easy to protect the wrong one.
Why the email domain is the one that counts
When you send an email, the receiving server (Gmail, Outlook, a client’s company server) looks at the domain in your From address: you@yourcompany.com. It asks that domain three questions:
- SPF: is the server that sent this message allowed to send for this domain?
- DKIM: is the message signed with a key this domain published?
- DMARC: if a message fails, what does the domain owner want done with it, and do the SPF or DKIM domains match the From address?
Your website’s domain plays no part in this. A perfect setup on yourcompany.ca does nothing for mail sent from yourcompany.com.
How a business ends up with two domains
It happens for ordinary reasons:
- The company started on a .com, then added a .ca (or .fr) for the local market, and the website moved to it.
- The email was set up years ago by someone else, on whichever domain existed then.
- A rebrand created a new domain for the site, and nobody wanted to change everyone’s email address.
None of this is a problem in itself. It only becomes one when each domain’s records are set up as if it were the only one.
Check each domain you own
Make a list of every domain the business owns, then sort them into two groups.
Domains you send email from
For each one, you want:
| Record | What it should do |
|---|---|
| SPF | List every service that sends for you: your mailbox provider, your newsletter tool, your invoicing software |
| DKIM | Be switched on in each of those services, which publish a key on your domain |
| DMARC | Exist, start with a monitoring policy (p=none) and a reporting address, then move to quarantine once the reports look clean |
Domains you don’t send email from
These need protecting too, because anyone can put any domain in a From address. A domain with no records is an easy one to impersonate. Three short records lock it down:
- An SPF record that allows nobody:
v=spf1 -all - A DMARC record that rejects everything:
v=DMARC1; p=reject; - Optionally, a “null MX” record (
0 .) that says the domain receives no email
What to do now
- Look at the email address you actually use, and note its domain.
- Run that domain through a check, then do the same for your website’s domain if it is different.
- Fix the sending domain first. Then lock down any domain that doesn’t send.
It takes a few minutes to check, and usually under an hour to fix once you have access to your DNS.
Check your own site first, for free:
Free email deliverability checkSPF, DKIM and DMARC for your domain, in a few seconds.