Why Your Emails Go to Spam: SPF, DKIM and DMARC Explained Simply
TL;DR: Email providers like Gmail and Outlook decide whether to trust your mail mostly by checking three DNS records: SPF, DKIM and DMARC. If one is missing or wrong, good emails land in spam or vanish. Set up all three for every service that sends as your domain, check them after any change, and have a backup sender for the emails that must never fail.
When customers say "I never got the email", it is tempting to blame them. Usually the problem is on your side, and it is fixable in an afternoon.
We run all the email for Total Football Studio, our own product: sign-up and login emails, a welcome series, team invites and a regular newsletter to hundreds of subscribers. Here is what we learned keeping it out of spam.
//The three records in plain English
What is SPF?
SPF is a list of the services allowed to send email for your domain. It lives in one DNS record. When Gmail receives a message from you, it checks whether the server that sent it is on your list.
What is DKIM?
DKIM is a digital signature. Your email service signs every message, and publishes the matching key in your DNS. The receiver checks the signature to confirm the message really came from you and was not changed on the way.
What is DMARC?
DMARC tells receivers what to do when a message fails SPF or DKIM: let it through, send it to spam, or reject it. It also asks them to send you reports, so you can see who is sending as your domain.
//How to set them up
- 1List every service that sends email as your domain. Your mailbox provider, your newsletter tool, your app's login emails, your invoicing tool, your CRM. People forget at least one.
- 2SPF: one record, all services included. You can only have one SPF record per domain. Add each service's "include". Keep it under the limit of ten DNS lookups.
- 3DKIM: one key per service. Each service gives you its own record to add. Add them all, then verify inside each service.
- 4DMARC: start gentle. Begin with a policy that only monitors and sends reports. Once everything passes, tighten it so failing mail goes to spam.
- 5Test. Send to a Gmail address, open the message, choose "Show original" and check that SPF, DKIM and DMARC all say PASS.
Since 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC in place, plus one-click unsubscribe on marketing email. This is no longer optional for newsletters.
//The mistakes we actually hit
The wrong region in the SPF record
Some email services run separate server regions, for example one for the US and one for Europe, with different addresses for each. Our SPF record pointed to the US region while our account sent from the EU. The two lists of servers do not overlap, so the first campaign would have failed SPF. A one-word fix, but only if you spot it.
Hidden Apple addresses
Apple lets users hide their real email behind a private relay address. Mail to those addresses only arrives if your sending domain is registered with Apple. If you offer Sign in with Apple, register your sender, or a slice of your users will never get your emails.
One provider, one point of failure
Our main email provider ran out of credit with no warning. Sign-up and password emails depend on it, so when it fails, it looks like users simply never confirm. We moved all mail to a new provider within two days and added a second one behind it. Now if the first fails, mail goes out through the backup automatically.
//A quick checklist
| Check | What good looks like |
|---|---|
| SPF | One record, every sending service included, under ten lookups |
| DKIM | A key for each service, verified in each dashboard |
| DMARC | Present, reports arriving, tightened once everything passes |
| Gmail "Show original" | PASS on all three |
| Unsubscribe | One click on every marketing email |
| Critical emails | A backup provider for sign-up, login and invoices |
//Frequently asked questions
Why do my emails go to spam even with SPF set up?
SPF alone is not enough. Without DKIM and DMARC, or with a service missing from your SPF record, providers still treat your mail with suspicion.
Can I have two SPF records?
No. Multiple SPF records make SPF fail. Combine every service into one record.
How long do DNS changes take?
Usually minutes to a few hours. Test with "Show original" in Gmail before sending anything important.
Do I need DMARC for a small business?
Yes, if you send newsletters or any volume of mail. Gmail and Yahoo require it for bulk senders, and it protects your domain from being used by scammers.
See how we built every email for our product in the email marketing and automation case study. Emails landing in spam? We can fix it.