Why your business emails land in spam: SPF, DKIM and DMARC explained
If emails from your domain go to spam, three DNS records are usually the reason. What SPF, DKIM and DMARC do, in plain language, and how to check yours.
You set up you@yourbusiness.com, send a quote to a new customer, and it lands in their spam folder. The most common cause is not your wording. It is three missing or incorrect DNS records.
What the three records do
Think of them as ID checks for your domain.
SPF: who is allowed to send
SPF lists the servers allowed to send email for your domain, for example your email provider and the tool that sends your invoices. If an email comes from a server not on the list, receivers grow suspicious.
DKIM: was the email changed?
DKIM adds a digital signature to every email you send. The receiving server checks it against a public key in your DNS. If it matches, the email really came from you and was not altered on the way.
DMARC: what to do when checks fail
DMARC tells receivers what to do with email that fails SPF or DKIM — let it through, send it to spam, or reject it — and where to send reports. Large mailbox providers increasingly expect domains that send email to have DMARC set up.
How to tell if yours are set up
- Send an email to a Gmail address, open it, choose Show original, and look for SPF, DKIM and DMARC results. You want to see PASS for each.
- Most email providers (such as Google Workspace and Zoho) show the exact records to add in their admin panels.
Common mistakes
- Two SPF records. A domain should have one SPF record that includes every sender.
- Forgetting other senders. Your website's contact form, invoicing tool or newsletter service may send as your domain too. Each needs to be covered.
- Starting DMARC on "reject". Start in monitoring mode, read the reports, then tighten.
The short version
Set up SPF, DKIM and DMARC once, test them, and keep a note of every service that sends email for you. It takes an hour and quietly fixes a problem that costs leads every week.