Why Your Business Emails Land in Spam: SPF, DKIM, DMARC, and More
If clients say your emails end up in spam, the cause is usually DNS. Here is how SPF, DKIM, DMARC, reverse DNS, and blacklists affect deliverability.
"Check your spam folder" should not be part of your sales process. When invoices, proposals, or password reset messages from your domain land in junk, the cause is rarely the wording. It is usually missing or misconfigured authentication records in DNS.
Since 2024, Google and Yahoo require bulk senders to have SPF, DKIM, and DMARC in place, and Microsoft has followed with similar requirements. Even if you send far less than the bulk thresholds, receiving servers increasingly treat unauthenticated mail with suspicion.
SPF: who is allowed to send
Sender Policy Framework is a TXT record that lists the servers authorized to send mail for your domain.
example.com. IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"
Common mistakes:
- More than one SPF record. You can only have one. Merge them.
- Too many lookups. SPF allows a maximum of 10 DNS lookups. Every
includecounts, and nested includes count too. - Forgotten senders. Your website contact form, CRM, invoicing platform, and copier scan-to-email all send mail. Each needs to be covered or routed through an authorized server.
Use -all (fail) once you are confident the list is complete, or ~all (softfail) while you are still auditing.
DKIM: proof the message was not altered
DomainKeys Identified Mail adds a cryptographic signature to each message. The receiving server checks it against a public key published in your DNS.
google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
Your email provider generates the key pair. You publish the public key, then enable signing in the provider's admin panel. A frequent oversight is publishing the record but never turning signing on. Every third-party platform that sends as your domain should sign with its own DKIM key.
DMARC: the policy that ties it together
DMARC tells receivers what to do when a message fails SPF and DKIM alignment, and where to send reports.
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"
Roll it out gradually:
- p=none for a few weeks. Collect reports and identify every legitimate sender.
- p=quarantine once legitimate mail passes consistently.
- p=reject when you are confident. This also stops others from spoofing your domain, which protects your clients from phishing that impersonates you.
The aggregate reports are XML and not pleasant to read by hand. A DMARC report analyzer makes them usable.
Reverse DNS: important if you run your own mail server
If you send from your own server, such as a cPanel/WHM host or an on-premises Exchange server, the sending IP needs a PTR record that resolves to a hostname, and that hostname should resolve back to the same IP.
dig -x 203.0.113.25 +short
# mail.example.com.
dig mail.example.com +short
# 203.0.113.25
PTR records are set by whoever owns the IP block, usually your hosting provider or ISP, not in your own DNS zone. Many receivers reject mail outright from IPs without valid reverse DNS.
Blacklists
If a server on your network was compromised, or a shared hosting neighbor sent spam, your IP may be listed on a DNS blocklist such as Spamhaus or Barracuda. Check your sending IP with a multi-blacklist lookup tool. If listed:
- Find and fix the cause first: a compromised mailbox, an outdated website plugin, an open relay.
- Then request delisting through the list operator's process.
Requesting removal without fixing the root cause usually ends with a quick relisting.
Other factors that matter
- Consistent From addresses that match your authenticated domain
- Clean mailing lists with low bounce rates and easy unsubscribe options for newsletters
- TLS enabled on your mail server
- Separate domains or subdomains for marketing versus transactional mail, so a campaign problem does not affect invoices
A quick self-check
Send a message from your domain to a Gmail account, open it, and choose "Show original." You will see SPF, DKIM, and DMARC results at the top. All three should say PASS. If any do not, you have found your starting point.
Need a hand?
Email authentication is one of those tasks that is simple once it is done correctly and confusing until then. If your messages are landing in spam, or you are not sure who is sending on behalf of your domain, book a free IT assessment. We will review your DNS, identify every sender, and put a clear plan in place.
