Why Your Business Emails Land in Spam — SPF, DKIM and DMARC in Plain English

You send an invoice, a booking confirmation or a newsletter — and the customer never sees it because it landed in spam. For a small business this quietly costs money. In many cases the cause isn't the content of the email at all, but the fact that the receiving server can't confirm the email really came from you.

That confirmation is handled by three DNS records: SPF, DKIM and DMARC.

The problem these records solve

Email was designed decades ago without any built-in way to prove who sent a message. Anyone can put your company's address in the "From" line. Mailbox providers such as Gmail, Yahoo and Outlook therefore look for proof that a message claiming to be from your domain was authorised by you. If the proof is missing, the message is more likely to be filtered or rejected.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain — for example, your email provider and the service you use for newsletters.

When a message arrives, the receiving server checks whether it came from one of those listed servers.

Common mistakes:

• Forgetting to add a service you send through, such as your website's contact form or invoicing software.
• Having two SPF records on the same domain. There must be only one; combine them.

DKIM: a digital signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email. Your email provider gives you a public key to publish in your DNS, and receiving servers use it to verify the signature.

DKIM proves two things: that the message was sent by a server holding your key, and that it wasn't altered on the way. Unlike SPF, it usually survives when an email is forwarded.

DMARC: the policy that ties it together

DMARC tells receiving servers what to do when a message fails the checks, and sends you reports about who is sending email using your domain.

The key idea is alignment: the domain in the visible "From" address must match the domain that passed SPF or DKIM. A typical rollout looks like this:

1. Start with p=none — monitor only, and read the reports.
2. Once all your legitimate senders pass, move to p=quarantine (failing mail goes to spam).
3. Finally, p=reject (failing mail is refused), which stops others from impersonating you.

What the big mailbox providers require

Since 2024, Google and Yahoo have required bulk senders — those sending around 5,000 or more messages a day to their users — to authenticate with SPF and DKIM, publish a DMARC record (at least p=none), keep spam complaint rates low (Google sets the line at 0.3%), and offer easy one-click unsubscribe in marketing emails. Microsoft announced similar requirements for Outlook.com, Hotmail and Live addresses, with enforcement beginning in May 2025.

Even if you send far fewer emails, meeting the same standards is the simplest way to stay out of the spam folder.

A quick checklist

1. List every service that sends email as your domain: mailbox provider, website forms, newsletter tool, invoicing, booking system.
2. Make sure one SPF record includes all of them.
3. Turn on DKIM in each service and publish the keys it gives you.
4. Publish a DMARC record starting with p=none and an address to receive reports.
5. Check a sent message's headers ("Show original" in Gmail) — you want to see SPF, DKIM and DMARC all marked PASS.
6. Keep your lists clean: only email people who asked to hear from you, and make unsubscribing easy.

The bottom line

Spam filtering isn't personal; it's about proof. Publish correct SPF, DKIM and DMARC records, send only to people who expect your emails, and your messages are far more likely to reach the inbox.

Sources

• dmarcian: Yahoo and Google require DMARC