Why Your Emails Land in Spam — Fix It With SPF, DKIM & DMARC
- Why Email Authentication Matters More Than Ever
- Step 1: Set Up SPF
- SPF Syntax Explained
- Step 2: Configure DKIM
- DKIM DNS Record Format
- Step 3: Enforce DMARC
- Start with a Monitoring Policy
- Escalate to Enforcement After 30 Days
- Step 4: Fix Your Sending Reputation
- ✅ Email Deliverability Checklist
- Emails Still Landing in Spam?
Why Your Emails Land in Spam — And How to Fix It With SPF, DKIM & DMARC
If your business emails are landing in spam, you’re losing revenue. This guide explains exactly why it happens and how to configure SPF, DKIM, and DMARC to fix it permanently.
Key Stat: 45% of all email is spam. Gmail and Outlook now reject or filter emails without proper SPF, DKIM, and DMARC authentication — even from legitimate businesses.
Why Email Authentication Matters More Than Ever
In 2024, Google and Yahoo made SPF, DKIM, and DMARC mandatory for bulk senders. But even for regular business email, missing these records means your emails get filtered or rejected. The result: lost leads, missed invoices, and damaged sender reputation.
Three records protect your email domain:
- SPF (Sender Policy Framework) — Tells receiving servers which IP addresses are allowed to send email for your domain
- DKIM (DomainKeys Identified Mail) — Adds a cryptographic signature to every outgoing email, proving it wasn’t tampered with
- DMARC (Domain-based Message Authentication) — Tells receivers what to do if SPF or DKIM fails, and sends you reports about who’s sending as your domain
Step 1: Set Up SPF
An SPF record is a DNS TXT record that lists all servers authorized to send email for your domain.
SPF Syntax Explained
v=spf1— SPF versioninclude:— Allow servers from another domain’s SPFip4:— Authorize specific IP addresses~all— SoftFail (filter but don’t reject). Use-allfor HardFail once tested.
⚠️ SPF Lookup Limit: SPF has a maximum of 10 DNS lookups. Exceeding this causes a “permerror” and SPF fails. Use a flattening service if you have many include: statements.
Step 2: Configure DKIM
DKIM adds a digital signature to every email you send. It requires generating a key pair and publishing the public key in DNS.
DKIM DNS Record Format
- For Microsoft 365: Enable DKIM in Exchange Admin Center → Email Authentication
- For Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate email
- For custom SMTP servers: Generate a 2048-bit RSA key pair and publish the public key as a TXT record
Step 3: Enforce DMARC
DMARC ties SPF and DKIM together and tells receivers what to do with emails that fail authentication.
Start with a Monitoring Policy
Escalate to Enforcement After 30 Days
| Policy | Action | When to Use |
|---|---|---|
p=none | Monitor only | Starting out — collect reports |
p=quarantine | Send to spam | After 2–4 weeks of clean reports |
p=reject | Block completely | Full enforcement — highest protection |
Step 4: Fix Your Sending Reputation
Even with perfect authentication, a bad sending reputation will land you in spam. Check these:
- Check blacklists — Use MXToolbox to see if your IP or domain is listed on any RBL (Real-time Blackhole Lists)
- Reverse DNS (PTR record) — Your sending IP must have a PTR record matching your mail server hostname
- Bounce rate — Keep hard bounces under 2% or ISPs will throttle your email
- Spam complaint rate — Google Postmaster Tools shows your complaint rate; keep it under 0.1%
- Warm up new IPs — Never start sending bulk email from a new IP. Gradually ramp up volume over 4–6 weeks.
✅ Email Deliverability Checklist
- SPF record published with all sending sources
- DKIM enabled and keys published in DNS
- DMARC policy set (start with p=none, escalate to p=reject)
- PTR/rDNS record configured for sending IP
- Domain not on any blacklists (MXToolbox check)
- Bounce rate below 2%
- DMARC reports reviewed weekly
Emails Still Landing in Spam?
CloudShift360 audits and fixes email deliverability issues within 2 weeks. We configure SPF, DKIM, DMARC, and monitor your sender reputation — guaranteed inbox placement.
Get a Free Email Audit →🚀 Need Help With Your Cloud Infrastructure?
We have optimized AWS, Azure, and GCP environments for 88+ enterprise clients reducing costs by an average of 35% and achieving 99.9% uptime SLA. Let us audit your setup for free.
- ✓ Free 30-minute cloud audit
- ✓ Written action plan, no obligation
- ✓ Available this week