Why Your Email Lands in Spam: SPF, DKIM, and DMARC Explained Print

The symptom

Your email is being sent successfully, no bounces, no errors, but recipients keep finding it in their Spam or Junk folder, or worse, they tell you it never arrived and it turns out it was in spam all along. This is a deliverability problem, and it is fixable, but the fix lives in your domain's DNS settings rather than in your mail program.

How receiving servers decide what is spam

When your email arrives at Gmail, Outlook, or a company mail server, that server asks one question above all: can this sender prove the message genuinely comes from the domain it claims to come from? Spammers forge sender addresses constantly, so a message that cannot prove itself starts on the back foot no matter how legitimate its content is.

Three DNS records provide that proof, and together they are the foundation of email deliverability:

• SPF is a public list of the servers allowed to send mail for your domain. If a message arrives from a server not on the list, it fails the check. Crucially, the list must include every service that sends as your domain: our mail server, your website's contact form and shop, and any newsletter or invoicing service you use.
• DKIM is a digital signature added to every outgoing message, which the receiving server verifies against a public key in your DNS. A valid signature proves the message was not forged or tampered with in transit.
• DMARC ties the two together. It tells receiving servers what to do with mail that fails the checks (deliver it anyway, quarantine it to spam, or reject it) and where to send reports. Gmail and Yahoo now require a DMARC record for anyone sending in volume, so this has moved from optional to expected.

The usual causes when mail goes to spam

• A missing or incomplete SPF record. The most common cause we see. Typically the record covers our server but not a newsletter tool, or the domain recently moved and the record was never updated.
• DKIM not enabled or its DNS record missing, which often happens when a domain's DNS is hosted away from us, the signature is being applied but the public key the world needs to verify it is not published.
• No DMARC record at all, increasingly penalised by the large providers regardless of content.
• Content and behaviour factors. All-image emails, misleading subject lines, purchased mailing lists, and sudden large sends from a quiet domain all raise spam scores even when authentication is perfect.
• Shared reputation. Occasionally the sending server's reputation dips because of another sender's behaviour. That side is our job, see the note at the end.

How to fix it

1. Test where you stand. Send an email from your domain to the free tester at mail-tester.com and it will grade your SPF, DKIM, DMARC, and content in one report. Do this before changing anything, so you know what is actually failing.
2. If your DNS is hosted with us, SPF and DKIM records are normally created automatically for your domain. If the test shows them missing or failing, open a support ticket with the test result and we will correct the records.
3. If you use outside services that send as your domain (Mailchimp, Xero, a booking system), each one needs to be added to your SPF record and usually has its own DKIM record to publish. The service's own setup page lists exactly what to add, send us that page in a ticket if you would like us to make the DNS changes.
4. Add a DMARC record if you have none. A safe starting point is a monitoring-only policy, which changes nothing about delivery but starts generating reports and satisfies the Gmail and Yahoo requirement. We can add this for you on request.
5. Fix the content side. Balance images with real text, make the subject line honest, send from an address that can receive replies, and only ever email people who asked to hear from you.

Good to know

Authentication gets your mail judged on its merits, it does not guarantee the inbox. A perfectly authenticated message with spammy content will still be filtered, and reputation recovers slowly, if your domain has been landing in spam for months, expect gradual improvement over weeks after the fix, not an overnight flip. And if mail-tester gives you a high score, your records are clean, and recipients across many different providers still spam-folder you, open a ticket, at that point we need to check the server's shared sending reputation, which is covered in our article on blacklists.