Why Your Emails Go to Spam: SPF, DKIM and DMARC Explained

You send a client a proposal and they say nothing arrived. The message is sitting in spam — or never got through at all. This is neither chance nor a whim of the mail provider: almost always the cause lies in three technical records that should be configured on your domain.

Let us look at how they work, how to check yours in five minutes and what to do if something is missing. No excess theory — only what affects delivery.

Why messages end up in spam in the first place

Email was created at a time when everyone on the network trusted everyone else. The protocol itself therefore has no sender verification: technically anyone can send a message from any address. That is exactly how most fraudulent “from your bank” campaigns work.

Three add-ons were invented to fight this. Each covers its own part:

Without these records your message looks anonymous to Gmail: there is nothing to verify, so it is safer to file it under spam. With them the opposite happens — the domain builds a reputation and messages arrive.

Step 1. Check SPF

SPF is a line in DNS listing the servers permitted to send mail from your domain. Open the SPF record check and paste your domain.

What to look at in the result:

• Whether the record exists at all. If it does not, that is the main spam cause, and it takes five minutes to fix.
• Whether there is exactly one. Two SPF records on a domain are worse than none: the standard requires exactly one, and with duplicates the check fails outright. This is the most common mistake after connecting a new sending service.
• How it ends. ~all means “softly”, -all means “strictly, reject the rest”. Start with the soft version and switch to strict once you are sure every server is listed.
• How many lookups it makes. The standard caps DNS lookups at 10. Every include: is one lookup, and with several services the cap is easy to exceed. The check then fails silently.

If the record is missing or looks questionable, the SPF generator will assemble a correct line for your services — Google Workspace, Microsoft 365, sending platforms, your hosting mail server.

Step 2. Check DKIM

DKIM adds a cryptographic signature to every message. The recipient’s mail server takes the public key from your DNS and verifies that the message really came from you and was not altered on the way.

The peculiarity of DKIM is that the key lives not at the domain root but under a selector — a separate name issued by your mail service. In Google Workspace it is usually google, in Microsoft 365 it is selector1 and selector2, sending platforms use their own.

Open the DKIM lookup, enter the domain and the selector. If a key is found, the signature is configured. If not, check two possibilities: either the selector is different (look in your mail service settings) or the record was simply never added to DNS.

Where to get the selector without guessing: open any message you have sent in Gmail, click “Show original” and find the DKIM-Signature line. The value after s= is the selector.

Step 3. Check DMARC

DMARC is the policy telling mail providers what to do with messages that failed SPF and DKIM. Without it every service decides for itself and the outcome is unpredictable.

The DMARC check shows the record and breaks down its tags. The key one is p, the policy:

• p=none — do nothing, only collect reports. This is where you start;
• p=quarantine — suspicious messages go to spam;
• p=reject — reject outright.

The second important tag is rua, the address for reports. Mail providers will send daily statistics there: how many messages passed the checks, how many failed, and from which servers. It is the only way to see whether somebody is sending spam in your name.

The rollout order we recommend to clients: first p=none for two or three weeks, read the reports, confirm that all your legitimate services pass. Then p=quarantine. Only after that, if needed, p=reject. Going straight to strict risks having some of your own mail stop arriving — a CRM newsletter everyone forgot about, for instance.

The DMARC generator will build a correct policy for you.

Step 4. Check the IP against blacklists

Even with flawless records, mail will not arrive if your server’s IP address landed in a spam database. This happens more often than you would expect: on cheap hosting you share an address with hundreds of other sites, and one compromised neighbour is enough.

The blacklist check runs the address against the main databases — Spamhaus, SpamCop and others. If there is a hit, each database has a delisting procedure: usually you fix the cause and file a request on their site. On shared hosting this is the host’s job — write to support with a link to the check result.

You can find your mail server’s IP through the DNS check: look at the MX records, then the A record of the server listed there.

Step 5. Do not forget PTR

The last and least known one. PTR is the reverse record: it turns an IP address back into a server name. Mail providers check it, and if PTR is missing or does not match the server name, that counts against your reputation.

The catch is that PTR is attached to an IP address rather than a domain, and it is controlled by the owner of that address — your hosting company, not your domain registrar. You can check it in the DNS check by choosing the PTR type and entering the IP address. If there is no record, that is a support ticket to your host.

Checklist: five minutes to verify

1. SPF — the record exists, there is exactly one, the 10-lookup cap is not exceeded.
2. DKIM — the key resolves under your selector.
3. DMARC — the policy is set and a report address is specified.
4. Blacklists — the IP is clean.
5. PTR — a reverse record exists.

If all five are green and mail still goes to spam, the cause is no longer technical. Look at the content: aggressive subject lines in capitals, many links in a short message, attachments in a first contact, sending to a purchased list. Technical records open the door, but the sender’s reputation is built by what you actually send.

All the checks mentioned here, plus 38 more tools, live in our webmaster catalogue. If configuring it yourself is not working out, get in touch and we will do it.