"Why does our email keep landing in spam?" The answer is usually not about content — it's about three acronyms: SPF, DKIM, DMARC. Without these set up correctly, even a great email can land in the spam folder — or worse, someone can send fake email from your domain.
SPF — who's allowed to send
SPF (Sender Policy Framework) is a DNS record listing which servers are allowed to send email on behalf of your domain. When a receiving server gets an email, it checks the SPF record: "did this really come from a server this domain authorized?" If the record is missing or wrong, anyone can send email pretending to be your domain.
v=spf1 include:_spf.google.com ~all
Common mistake: using multiple email services (say, Google Workspace plus a marketing tool) but only adding one service's SPF entry. The second service's emails need to be included too, or they'll land in spam.
DKIM — signature verification
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server verifies that signature against a public key your domain publishes — proving the email wasn't altered in transit and genuinely came from your server. Where SPF answers "who can send," DKIM answers "did this arrive unchanged."
DMARC — combines both and sets a policy
DMARC tells the receiving server what to do when SPF and DKIM fail: do nothing (p=none), quarantine it (p=quarantine), or reject it (p=reject). It also sends you reports of failed attempts — so you can see who's been trying to send email as your domain.
v=DMARC1; p=quarantine; rua=mailto:[email protected]
The right order: start with p=none and monitor the reports, make sure every legitimate sending source passes SPF/DKIM, then gradually move to quarantine, and finally reject. Jumping straight to reject can silently break a legitimate source you forgot about (a CRM integration, for example).
What changes after setup
A correctly configured SPF+DKIM+DMARC trio:
- Raises your inbox placement rate (Gmail and Outlook no longer default to inbox without checking these)
- Largely blocks phishing sent as your domain
- Has become a requirement Google/Microsoft have enforced for bulk senders since 2024
The easiest way to check
Run dig TXT yoursite.com and dig TXT _dmarc.yoursite.com to see your current records. If you have none, or aren't sure what they say, get in touch — we usually finish setup within an hour.
