Get in touch

Why are my emails going to spam? SPF, DKIM and DMARC explained

Envelope with a green verified shield and SPF, DKIM and DMARC labels

You send a quote to a new customer and hear nothing back. A week later they find it in their junk folder. If that sounds familiar, the problem is rarely what you wrote. It’s usually that the receiving mail server can’t prove the email really came from you.

Three DNS records solve most of this: SPF, DKIM and DMARC. They sound technical, but the idea behind each one is simple. This guide explains what they do, how to check yours, and the mistakes I see most often when I’m asked to fix business email.

Why email ends up in spam

Anyone can put any address in the “From” line of an email. Spammers and scammers rely on that. So Gmail, Outlook and every other provider look for evidence that a message is genuine before they deliver it to the inbox. If the evidence is missing or doesn’t add up, the message is marked as suspicious or rejected outright.

Since 2024, Google and Yahoo have required everyone sending to their users to have at least SPF or DKIM in place, and bulk senders to have all three. Microsoft followed for Outlook.com in 2025. Domains that were fine for years are now landing in spam simply because these records were never set up.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a list, published in your domain’s DNS records, of the servers allowed to send email for your domain. When a message arrives claiming to be from you, the receiving server checks whether it came from one of those servers.

A typical SPF record for a business on Microsoft 365 looks like this:

v=spf1 include:spf.protection.outlook.com -all

The include parts name the services that send for you. The -all at the end tells other servers to reject anything else. If your website, invoicing software or newsletter tool also sends email as your domain, each of them needs to be in the list too.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The matching public key sits in your DNS. The receiving server uses that key to check the signature, which proves two things: the message really came from your domain, and nobody changed it on the way.

You don’t write DKIM records by hand. Microsoft 365, Google Workspace, cPanel and Plesk all generate them for you. The step people miss is publishing the record in DNS and then switching signing on. In Microsoft 365 especially, DKIM is often left switched off for custom domains.

DMARC: what to do when checks fail

DMARC ties SPF and DKIM together. It tells receiving servers what to do with a message that claims to be from you but fails both checks, and where to send reports about it. A sensible starting record is:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk

p=none means “just report, don’t block anything yet”. After a few weeks of reports, once you’re sure every legitimate sender passes, you tighten it to p=quarantine (send failures to spam) and eventually p=reject. That last step is what stops criminals sending fake invoices in your name.

How to check your own domain

  1. Send an email from your business address to a Gmail account.
  2. Open it in Gmail, click the three dots and choose Show original.
  3. At the top you’ll see SPF, DKIM and DMARC, each marked PASS or FAIL.

Free tools such as MXToolbox will also look up your records and flag common errors. If all three say PASS, your setup is in good shape. If any say FAIL or are missing, that’s very likely why your email is struggling.

The mistakes I fix most often

  • Two SPF records. A domain can only have one. Adding a second one for a new service breaks both. Merge them into a single record.
  • The website isn’t included. Contact form emails sent from the web server fail SPF. The fix is to send them through your real mailbox with an SMTP plugin, or add the server to SPF.
  • Too many lookups. SPF allows a maximum of 10 DNS lookups. Every include uses at least one, and a long list of services quietly goes over the limit.
  • DKIM generated but never switched on. The record is in DNS, but the mail service isn’t signing messages.
  • DMARC jumped straight to reject. Without reading the reports first, it’s easy to block your own invoices or newsletters.

Still going to spam?

Authentication is the foundation, but it isn’t the whole story. A blacklisted server IP, a new domain with no sending history, or emails full of links and images can still trip spam filters. If your records pass and mail still isn’t arriving, the next step is to look at the sending server and its reputation.

I set up and fix business email on Microsoft 365, Google Workspace, cPanel and Plesk, including SPF, DKIM and DMARC. If your emails are going missing, see how I can help with business email or get in touch and I’ll take a look.

Related posts