Why Your Email Lands in Spam: SPF, DKIM and DMARC, Explained
Somewhere between your Send button and your customer's inbox, three DNS records decide whether the message is delivered, quarantined or dropped. Most small businesses have never seen them. Since 2024 the big mail providers check them on every message.
“My emails are going to spam” is one of the most common calls we get from businesses, and it's rarely about the words in the email. It's about whether the receiving server can prove the message came from you. Three records make that proof. Here's what each one does, how to see whether yours pass, and the handful of mistakes behind almost every failure.
The Short Version
SPF lists who may send mail for your domain. DKIM signs each message so it can't be altered. DMARC tells receivers what to do when the first two fail, and sends you reports. Google and Yahoo have required SPF and DKIM for everyone since February 2024 and DMARC for anyone sending in volume, and Microsoft followed for Outlook.com accounts in 2025. If you use Microsoft 365 or Google Workspace, SPF is probably set, DKIM is probably not turned on, and DMARC is almost certainly missing.
What Each One Does
| Record | What it is | What it proves | What breaks it |
|---|---|---|---|
| SPF | A TXT record listing the servers allowed to send as your domain | The message came from a server you approved | A sender you forgot to list; more than ten lookups in the record; two SPF records |
| DKIM | A cryptographic signature on each message, checked against a public key in your DNS | The message wasn't altered, and came from your domain | Never switched on at the mail provider; a marketing tool signing as itself instead of you |
| DMARC | A policy record: what to do when SPF and DKIM fail, and where to send reports | The From address matches the domain that was authenticated | Jumping straight to reject before reading the reports |
How to Check Yours in Two Minutes
- Send a message from the business address to a Gmail account.
- Open it in Gmail, choose Show original, and read the three lines near the top. SPF, DKIM and DMARC each say PASS or FAIL.
- For the records themselves, use the SPF, DKIM and DMARC lookups at MXToolbox, or from a command prompt:
nslookup -type=txt yourdomain.com nslookup -type=txt _dmarc.yourdomain.com
A blank result on the second one means you have no DMARC record at all.
The Mistakes That Break It
- The sender nobody listed. The website contact form, the copier that scans to email, the CRM, the invoicing tool, the newsletter platform. Every one of them sends mail as you, and every one has to be in SPF and signing with DKIM. The copier is the one everyone forgets.
- Too many includes. SPF allows ten DNS lookups, and each tool you include counts its own. Past ten, the record fails for everyone. Flatten it, or move tools to a subdomain.
- Two SPF records. Receivers treat that as none. Merge them into one.
- The contact form sending from the visitor's address. It sets From to the visitor's email, which your domain can't authenticate. Send from your own address and put the visitor in Reply-To.
- Forwarding. Someone forwards your message and SPF fails on the hop. DKIM survives forwarding, which is why you need both.
- Reject on day one. A DMARC policy of reject with one unlisted sender silently drops your own invoices. Start at none, read the reports, then tighten.
- Newsletters from the main domain. Bulk mail draws complaints, and complaints hurt the reputation of the domain your invoices come from. Send it from a subdomain.
- The content. Link shorteners, an all-image email and a subject line in capitals still trip filters after authentication passes. Bulk senders also need a one-click unsubscribe and a complaint rate under 0.3 percent.
DMARC Is Also Fraud Protection
With DMARC at quarantine or reject, nobody can send a message from your exact address to your customers; the fake invoice with your name on it goes to spam at the other end. It doesn't stop lookalike domains, which is why the callback rule in our wire fraud guide still applies.
The Rollout Order
- SPF: list every sender, and stay under ten lookups.
- DKIM: turn it on in Microsoft 365 or Google Workspace, and separately in every tool that sends as you.
- DMARC at p=none with a reporting address, then wait two to four weeks.
- Read the reports. A free DMARC reporting service turns the raw XML into a list of who is sending as you, including the senders you didn't know about.
- Move to quarantine, then reject, once every legitimate sender passes.
If You're Already in the Spam Folder
Fix authentication first; nothing else works without it. Then check whether your domain or your sending address is on a blocklist, ask your best customers to mark a message Not Spam, and set up Google Postmaster Tools to watch your reputation recover. Recovery takes weeks, not days, and it doesn't start until the records are right.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Does a message to Gmail show SPF, DKIM and DMARC all passing? | Send one now |
| Is the copier or the website form in your SPF record? | Almost certainly not |
| Is DMARC at none, quarantine or reject? | Blank means none |
| Do you send newsletters from your main domain? | Move them |
Have Us Set Up Deliverability Properly
SPF, DKIM and DMARC for every sender you own, the reports read, and the policy tightened in stages, as part of our email services for Microsoft 365, Google Workspace and Proton Mail.
Frequently Asked Questions
I'm on Microsoft 365. Isn't this automatic?
SPF is usually set during setup. DKIM has to be turned on per domain in the admin center, and most tenants we look at never had it done. DMARC is never automatic; someone has to publish the record and read the reports.
Does this apply to my personal Gmail address?
No. Google handles authentication for gmail.com addresses. This applies to any domain you own and send from, which is every business address.
Why do my emails to one particular client bounce?
Their filter is stricter than most. The bounce message names the failure, usually in the last few lines. Fix authentication first, then check whether your domain is on a blocklist.
Why does forwarded mail fail?
SPF checks the last server that handed the message over, which after a forward is the forwarder, not you. DKIM survives forwarding because the signature travels with the message, which is why both records matter.
Will DMARC block my own newsletter?
If the newsletter tool isn't signing with your domain's DKIM key, yes, once the policy tightens past none. Set it up in the tool first. The p=none reports will show you whether it's passing before anything gets blocked.
More Guides
Setup, migration, deliverability and security for Microsoft 365, Google Workspace and Proton Mail.
Domain in your name, static hosting and managed email as one package.
The registrant on record owns it, not the person who pays the invoice. How to check.
How business email compromise moves real money, and the callback rule that stops it.
The five tells, the scams hitting Tampa Bay right now, and what to do if you already clicked.
The five real causes, including the scan-to-email that stopped working.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service