My business emails are going to spam: how to fix it with SPF, DKIM and DMARC

01 / Guides

Emails going to spam: how to fix it, the short answer

First check whether your domain is authenticated. Send an email to a Gmail address, open it there, click the three dots and choose Show original. At the top you will see three lines: SPF, DKIM and DMARC. If all say PASS, the problem is somewhere else. If any says FAIL or NONE, or a line is missing, you have found the cause.

The fix is then three lines of text in your domain's DNS settings, wherever the domain is registered: GoDaddy, Namecheap, IONOS, Hostinger, Cloudflare and so on. You usually do not need any coding skills, as long as you know exactly what goes in. That is what this guide covers. If mailboxes or a website are moving to a new host at the same time, our overview of server setup for small businesses shows how the pieces fit together.

02 / Guides

Why are my emails going to spam? The usual causes

• No SPF, DKIM or DMARC record: the receiving server cannot check that the email really comes from you
• Two SPF records: adding a second record after a provider change, instead of editing the first, breaks both
• Your website contact form sends as someone else: it sends mail from the web server with the visitor's address as sender, which fails every check
• A new tool nobody added: your newsletter tool, invoicing software or shop sends with your address but is not in SPF and does not sign with DKIM
• Poor IP reputation: on cheap shared hosting you share the server with strangers who send spam. A blocklist lookup shows it
• Complaints and bulk sending: lots of marketing mail without an unsubscribe link, or frequent spam reports, costs you trust with Gmail and Outlook
• Content: one big image and no text, link shorteners, attachments with macros. Rarely the main cause, but it adds up

03 / Guides

Step 1: check what the recipient sees

1. 01

   Send a test to Gmail

   Send a normal email from your mailbox to a personal Gmail address. If your contact form is affected too, submit a form enquiry to that address as well.

2. 02

   Show original

   Open the email in Gmail, click the three dots at the top right and choose Show original. You see SPF, DKIM and DMARC, each with PASS or FAIL and the domain that was checked.

3. 03

   Read the header in Outlook

   Open the message in Outlook, then File, Properties, Internet headers. Look for Authentication-Results: it shows spf=, dkim= and dmarc= with the result.

4. 04

   Look up your DNS records

   A DNS lookup tool such as the Check MX tool in the Google Admin Toolbox or MXToolbox shows which SPF, DKIM and DMARC records your domain publishes.

5. 05

   Check blocklists

   Check your mail server's IP address and your domain against common blocklists such as Spamhaus. A listing explains sudden trouble despite correct records.

04 / Guides

Step 2: create and check your SPF record

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email in your name. Every service that sends with your address must be in it. Each provider documents the include value to add in its help pages.

Important: a domain may have only one SPF record. New services go into the existing record. An SPF record may also trigger no more than 10 DNS lookups when it is checked. Every include, a and mx counts, and so do nested includes. Add five services and you can easily go over the limit, at which point SPF fails.

05 / Guides

Example SPF records

Replace yourcompany.com with your domain. In the Name or Host field, many DNS panels use @ for the domain itself.

About the ending: ~all (soft fail) means other servers are suspicious, -all (fail) means other servers are not allowed. Both are fine once DMARC is in place. Never use +all, which allows every server in the world to send as you.

07 / Guides

Step 3: set up DKIM

DKIM (DomainKeys Identified Mail) signs every outgoing message with a private key. You publish the matching public key in DNS under a name like selector._domainkey.yourcompany.com. The key is always generated by your email provider; you only copy it into your DNS settings.

Google Workspace: in the Admin console go to Apps, Google Workspace, Gmail, Authenticate email, and generate a 2048-bit key. Google suggests the selector google. Add the TXT record it shows under google._domainkey, then click Start authentication in the Admin console.

Microsoft 365: in the Microsoft Defender portal go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, open the DKIM tab and select your domain. Microsoft shows two CNAME records for selector1._domainkey and selector2._domainkey. Add both, wait a few minutes, then enable DKIM.

Hosting providers: with most hosts DKIM is switched on in the email or domain settings of your account. If the domain is managed by the same company, it often adds the record itself; if not, you copy it across by hand. Newsletter tools have their own DKIM records on top.

08 / Guides

Step 4: set up DMARC for your domain

DMARC ties SPF and DKIM to the From address the recipient actually sees. A message passes DMARC when SPF or DKIM passes and the checked domain matches the domain in the From line. That match is called alignment, and it is exactly where contact forms and tools fail when they sign with their own domain instead of yours.

The DMARC record is a TXT record named _dmarc. Always start with the policy p=none. It does not change delivery, but it sends you daily reports showing which servers send in your name and whether they pass. Once every legitimate sender passes, usually after two to four weeks, move to quarantine and later to reject.

09 / Guides

Example DMARC records

Reports arrive as XML files in zipped attachments, often several a day. Create a separate address for them and use a DMARC reporting service that turns them into something readable. Many have a free tier for small domains.

11 / Guides

The Google and Yahoo sender rules since 2024 (and Microsoft since 2025)

In February 2024 Google and Yahoo introduced binding rules for senders. Google counts you as a bulk sender once you send close to 5,000 or more messages to personal Gmail accounts in one day, and that status is permanent. Since 5 May 2025 Microsoft has required the same from senders of more than 5,000 messages a day to Outlook.com, Hotmail and Live.com.

12 / Guides

Special case: your website contact form

Many WordPress sites send form emails through the web server's PHP mail function, and many forms put the visitor's address in the From field. To Gmail that looks like a forged message: the web server is not in the SPF record of the visitor's domain, and DMARC fails. The enquiry lands in spam or disappears.

The fix: the sender is always an address on your own domain, such as forms@yourcompany.com, and the visitor's address goes into Reply-To. Mail goes out over SMTP with a login at your email provider, in WordPress for example with a plugin such as WP Mail SMTP or FluentSMTP. From then on the message passes SPF, DKIM and DMARC like any email from your mailbox. It is worth checking if your website gets few enquiries, alongside the basics in our SEO guide for small businesses: sometimes the enquiries come in and quietly land in spam. We write our own sites by hand, without WordPress, and when we build one as part of our web design work, the form sends this way from day one.

13 / Guides

If only your own inbox sends mail to junk

Many searches for emails going to spam are really about the searcher's own inbox: Outlook or Gmail filters out mail they want. In that case, mark the message as Not junk or Not spam and add the sender to your safe senders list, and check your own filter rules. Your DNS records play no part in that; they only affect mail you send.