Why your emails are going to spam
Email was designed with no way to prove who sent a message, which is why spoofing and phishing are so easy. SPF, DKIM and DMARC fix that. Gmail, Yahoo and Microsoft Outlook now require them for anyone sending in bulk (roughly 5,000 or more messages a day to their users), and they treat unauthenticated mail with suspicion even from small senders. Since late 2025, Gmail has been rejecting non-compliant bulk mail outright rather than just sending it to spam.
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from one of those servers.
v=spf1 include:_spf.google.com include:sendgrid.net ~all- Each include adds a service that sends for you, such as your mailbox provider, newsletter tool or invoicing software.
- ~all (soft fail) marks anything else as suspicious. -all (hard fail) says reject it.
- You can only have one SPF record per domain. Merge services into one line rather than adding a second record.
- SPF allows at most 10 DNS lookups. Too many includes break it silently.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to every email. Your email provider signs outgoing messages with a private key, and you publish the matching public key in DNS. Receivers check the signature to confirm the message really came from your domain and wasn't altered on the way.
You don't write DKIM records yourself. Each sending service (Google Workspace, Microsoft 365, Mailchimp and so on) gives you a record to add, usually at an address like selector._domainkey.yourdomain.com. Turn it on in every service that sends as your domain.
What is DMARC?
DMARC ties SPF and DKIM together. It tells receivers what to do when a message claiming to be from your domain fails those checks, and where to send reports about it. Crucially, it requires alignment: the domain that passes SPF or DKIM must match the domain in the From address people see.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comThis record lives at _dmarc.yourdomain.com. The p value is your policy: none (monitor only), quarantine (send failures to spam) or reject (block them).
How to set up DMARC safely
- Publish a DMARC record with p=none and a reporting address. Nothing is blocked yet.
- Read the reports for two to four weeks. A DMARC reporting tool makes them readable. You'll find every service sending as your domain, including ones you'd forgotten, such as your CRM, booking system or website contact form.
- Fix SPF and DKIM for each legitimate sender until they all pass and align.
- Move to p=quarantine, and watch for problems.
- Once everything is clean, move to p=reject. Now nobody can send convincing email pretending to be you.
Do I need these if I don't send email from my domain?
Yes. Unused domains are a favourite target for spoofing because nobody is watching them. For a domain that never sends email, publish an SPF record of v=spf1 -all and a DMARC record with p=reject. That tells every receiver that any email claiming to be from this domain is fake.
How to check your SPF, DKIM and DMARC
Send an email to a Gmail address, open it, and choose Show original. Gmail shows PASS or FAIL for SPF, DKIM and DMARC. Pagelyt's security check also looks up your SPF and DMARC records on every scan. See how to add SPF and how to add DMARC, or run a free scan.
Frequently asked questions
Can I have two SPF records?
No. Two SPF records make SPF fail completely. Combine all your sending services into a single record with several include entries.
What is the difference between ~all and -all in SPF?
~all is a soft fail: unlisted senders are treated as suspicious. -all is a hard fail: they should be rejected. Most domains start with ~all and rely on DMARC to set the final policy.
Does DMARC stop spam in my inbox?
No. DMARC stops other people sending email that pretends to be from your domain. It doesn't filter the email you receive.
Is p=none enough for Gmail and Yahoo?
For their bulk sender rules, a DMARC record with p=none is the minimum. It doesn't protect your domain from spoofing, though, so plan to move to quarantine or reject.
How long do SPF, DKIM and DMARC changes take to work?
DNS changes usually take effect within minutes to a few hours, and can take up to 48 hours depending on your DNS settings.