Why Your Emails Are Going to Spam: SPF, DKIM, and DMARC

A business sends its monthly newsletter. Open rates look fine on the platform dashboard. Then a customer mentions they never get the emails, and a check of a few addresses shows the messages sitting in spam, or not arriving at all.

This is almost never a content problem. It is almost always a DNS problem, and it has become much less forgiving over the past two years.

What changed

For most of email’s history, the major inbox providers tolerated unauthenticated mail. They filtered it, complained about it, and delivered a lot of it anyway.

That ended in stages. Google and Yahoo introduced requirements for bulk senders in February 2024. Microsoft applied comparable requirements to its consumer domains in May 2025. Google escalated Gmail enforcement in late 2025, moving non-compliant senders from temporary delays to outright rejection.

The practical result is that the grace period is gone. Mail that fails authentication is increasingly rejected rather than delayed, and rejection produces no useful feedback for most senders.

Does this apply to you?

The formal threshold for bulk sender rules is 5,000 messages per day to a given provider, which most small businesses never reach.

Three reasons to configure everything anyway.

The threshold counts the whole domain, not one campaign. Your newsletter platform, your CRM, your invoicing software, your booking system, and your appointment reminders all send from your domain. Those add up faster than owners expect.

Some providers will not tell you. Yahoo declines to publish a specific volume threshold, defining a bulk sender as one sending a significant volume. You cannot total your own sends and safely rule yourself out.

All three providers recommend authentication for every sender regardless of volume. Below the threshold it is a recommendation. It is still the difference between landing in the inbox and landing in spam, and the configuration is the same either way.

The honest answer is that every business sending any email from its own domain should have all three records configured. It is a few DNS entries and it does not need to be revisited often.

The three records, in plain language

SPF: who is allowed to send as you

SPF is a DNS record listing the mail servers authorized to send email using your domain. A receiving server checks the list. If the message came from somewhere not on it, that is a failure signal.

The most common problem here is accumulation. A business adds Google Workspace, then a newsletter platform, then a CRM, then invoicing software, and each vendor’s setup guide says to add something to the SPF record. Nobody ever removes the entry for the tool that got cancelled two years ago.

That matters because of a limit most people have never heard of: an SPF record may only trigger ten DNS lookups. Exceed it and SPF does not just degrade, it fails permanently with an error, and deliverability collapses. Businesses using five or six third-party tools hit this more often than you would think.

If your email is mysteriously failing, checking your SPF lookup count is one of the first things to do.

DKIM: proof the message was not tampered with

DKIM attaches a cryptographic signature to outgoing mail, using a key published in your DNS. The receiving server verifies the signature, confirming both that the message really came from your domain and that it was not altered in transit.

Every service that sends on your behalf needs its own DKIM key published. This is where partial setups are common: your main email is configured but the marketing platform is not, so half your mail authenticates and half does not.

DMARC: the instruction for what to do on failure

DMARC ties the other two together. It tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports.

It has three policy settings.

• p=none monitors and reports without affecting delivery. This is the starting point and the minimum required by the bulk sender rules.
• p=quarantine sends failing mail to spam.
• p=reject tells servers to refuse it entirely.

The sequence that works is to publish p=none first, read the reports for a few weeks to find every legitimate service sending as you, fix anything failing, and only then move to quarantine. Going straight to reject before that discovery step is how businesses accidentally block their own invoicing software.

Leaving it at p=none forever is also not ideal. It is increasingly read as a weak trust signal, and quarantine is a reasonable target once your reports are clean.

Alignment is the piece people miss. It is not enough for SPF or DKIM to pass. The domain they pass for has to match the domain in your From address. A message that passes SPF for your email vendor’s domain but shows your domain in the From field is not aligned and fails DMARC.

The other requirements

Authentication is necessary and not sufficient.

One-click unsubscribe. Promotional mail needs a List-Unsubscribe header that lets someone unsubscribe from the inbox interface without visiting your site. Most reputable platforms support this, but verify it is switched on rather than assuming. Unsubscribes should be honored within about two days.

Spam complaint rate. Google’s stated line is to stay below 0.3 percent and its guidance points at 0.1 percent as the level to aim for. This is a small number. A few complaints on a small list moves it. The main cause is sending to people who do not remember signing up.

Valid reverse DNS and TLS. Mostly your provider’s responsibility, worth confirming if you run your own mail server.

A real From address. Sending from a no-reply address that discards responses is a negative signal and a bad customer experience simultaneously.

How to check your own setup

A practical sequence that takes under an hour.

1. Send yourself a test from every system that mails on your behalf: marketing platform, CRM, booking tool, invoicing, and your regular email. Open each one in Gmail, choose Show Original, and look for SPF, DKIM, and DMARC results. You want three passes on each.
2. Count your SPF lookups with any free SPF checker. If you are near ten, clean it up before it breaks.
3. Check whether a DMARC record exists at all. Many businesses have SPF and DKIM and no DMARC, which fails the bulk requirement on its own.
4. Set up Google Postmaster Tools for your domain. It reports your spam rate and reputation as Gmail sees them, which is otherwise invisible to you.
5. Read Google’s own sender guidelines rather than a third-party summary, including this one. They are the authority and they get updated.

What authentication will not fix

Getting the records right moves you from blocked to eligible. It does not put you in the inbox.

Engagement decides the rest. Providers watch whether people open, reply, and keep your mail, and whether they delete it unread or mark it as spam. A perfectly authenticated sender mailing a stale purchased list will still end up filtered.

Which brings it back to list hygiene, the least interesting and most effective thing in email marketing. Remove people who have not engaged in a year. Never buy a list. Use confirmed opt-in where you can. Send at a consistent cadence rather than going quiet for eight months and then blasting everyone.

And if you are texting as well as emailing, text has its own separate registration regime with its own failure mode, which we covered in our piece on A2P 10DLC. The pattern is the same in both channels: the message that never arrives generates no error and no complaint, so nobody finds out until a customer mentions it.

We set up email and SMS programs including the DNS configuration, and you own the domain, the records, and the list. Get in touch if your email has gone quiet and you are not sure why.