My Emails Are Going to Spam: A Lasting Fix With SPF, DKIM and DMARC

If emails sent from your business address are going to spam, the most common cause is missing or incorrect SPF, DKIM and DMARC records for your domain. These three DNS records tell the receiving side that the email really comes from the domain's owner. Since 2024, Gmail and Yahoo have been strict with unauthenticated email; without these records, the quotes, invoices and replies you send can disappear into customers' spam folders. Setting them up takes 20 to 30 minutes, depending on your email provider.

If the records are in place and the problem persists, the next suspects are a blacklisted server and the email's content.

Test first

A tool like mail-tester.com gives you a temporary email address. Send an ordinary email to it from your business address, then open the result. The tool gives a score out of 10 and shows the status of your SPF, DKIM and DMARC records, a blacklist check and content warnings on one page. A score below 8 means at least one of the steps below is missing.

Second test: send an email to a Gmail address, open it, and choose 'Show original' from the three dots at the top right. The SPF, DKIM and DMARC lines should say PASS.

SPF: who may send?

An SPF record lists which servers are authorised to send email for your domain. It's a TXT record added to the domain itself in DNS and begins with v=spf1.

• If you use Google Workspace, the record is usually: v=spf1 include:_spf.google.com ~all
• For Microsoft 365: v=spf1 include:spf.protection.outlook.com ~all
• If you use your hosting company's email, take the record they recommend from their help pages.

Two rules are often broken. First, a domain can have only one SPF record. If you use both Google and a newsletter service, combine them in a single record rather than adding two. Second, if your website's form emails or your newsletter service also send in your domain's name, they need to be in this record too. Otherwise emails from your site's form get rejected; we cover that separately in contact form emails not arriving.

DKIM: the email wasn't altered on the way

DKIM adds a digital signature to every outgoing email. The receiving server checks the signature against the key in DNS. If it matches, the email really left your server and wasn't changed in transit.

You turn DKIM on in your email provider's panel:

• In Google Workspace, create a DKIM key under 'Authenticate email' in the Gmail settings of the Admin console, add the TXT record it gives you to DNS, and press 'Start authentication'.
• In Microsoft 365, enable DKIM in the email authentication settings of the Defender portal and add the two CNAME records it gives you to DNS.
• With hosting email, DKIM can often be set up in one click on cPanel's 'Email Deliverability' page.

DNS changes can take a few hours to spread. Once the provider's panel shows DKIM as active, repeat the test email.

DMARC: rules and reports

DMARC works on top of SPF and DKIM. It tells the receiving server what to do when an email fails authentication, and arranges for reports to be sent to you. It's a TXT record at _dmarc.yourdomain.com.

A safe starting record looks like this: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none starts monitoring without blocking any email. After following the reports for a few weeks (or a free service that makes them readable) and seeing that all your legitimate sending sources pass SPF and DKIM, you can raise the policy to p=quarantine (suspicious email goes to spam). Starting straight with p=reject can block every email from a sending source you forgot about, such as your accounting software's invoice emails.

A DMARC record also makes it harder for others to send forged email in your domain's name. Without it, sending your customers fake invoices in your name is much easier.

Records are fine but mail still goes to spam

Blacklists. If you send email from your host's shared server, its IP address may have been blacklisted because of spam from another account on the same server. Run a blacklist check with a tool like MXToolbox. If you're listed, tell your host; the lasting fix is to move email to a separate service such as Google Workspace or Microsoft 365. We compare the options in business email options.

A new domain. A domain that is a few weeks old has no email history, and providers treat it cautiously. Avoid bulk sending in the first weeks and increase volume gradually.

Bulk sending from a personal mailbox. Sending a campaign or newsletter from your own inbox to hundreds of people harms the reputation of both that mailbox and the domain. Use a newsletter service for bulk sends and add it to SPF and DKIM.

Content. Emails made of a single image, link shorteners, subject lines in all caps and password-protected ZIP attachments trigger spam filters. Plain text, a few links and a familiar signature are safest.

Forwarding. If you automatically forward email to another mailbox, SPF can break on the way. That's another reason DKIM is essential.

A little help on the recipient's side

If an important customer finds your emails in spam, ask them to mark the email 'not spam' and add your address to their contacts. That trains the filter for that recipient. But the lasting fix is always the authentication records.

If editing DNS records is unfamiliar territory, our DNS settings guide explains where and how to add records. If you'd like us to check your domain's email records and fill in what's missing, write to us; it can also be part of the technical checks in our maintenance and support plan.