SPF, DKIM and DMARC: Why Your Business Emails Land in Spam

Short answer: SPF, DKIM and DMARC are three DNS records that prove email from your domain really comes from you. Since February 2024 Gmail and Yahoo require every sender to have at least SPF or DKIM, and bulk senders to have SPF, DKIM and DMARC; Microsoft's Outlook.com added similar rules for high-volume domains in May 2025. If your invoices, quotes or newsletters keep landing in spam, missing or misaligned authentication is the first thing to check, and it's usually fixable in an afternoon.

A typical small-business story: the website sends contact-form emails through one service, invoices go out from accounting software, the newsletter tool sends campaigns, and staff use their own mailbox. Each of those sends "as" your domain, and each needs to be authorized. Miss one and that stream starts looking like spoofing.

The three records, explained

SPF: who's allowed to send

SPF (Sender Policy Framework) is a TXT record listing the servers and services permitted to send email for your domain. A receiving server checks whether the sending server appears on that list.

Example:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Rules of thumb:

one SPF record per domain (two records break it);
list every service that sends as your domain;
keep the number of DNS lookups within the SPF limit of 10, which matters once you add many include: entries.

DKIM: a signature on each message

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing email. You publish a public key in DNS; your sending service signs with the matching private key. If the signature checks out, the receiver knows the message wasn't altered and that your domain stands behind it.

Each sending service usually gives you its own DKIM record (often a CNAME) to add. Do this for every service, not just your mailbox provider.

DMARC: the policy and the reports

DMARC ties the other two to the address people actually see in the From: line, and tells receivers what to do when a message fails.

Example:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

p=none: monitor only; take no action on failures
p=quarantine: treat failing mail as suspicious (usually spam folder)
p=reject: refuse failing mail outright
rua: where aggregate reports go, so you can see who's sending as your domain

Alignment is the part people miss. Google's guidelines state that for direct mail, the domain in the From: header must be aligned with either the SPF domain or the DKIM domain to pass DMARC. If your newsletter tool signs with its own domain rather than yours, SPF and DKIM can both "pass" while DMARC still fails.

What the big mailbox providers require

Gmail (since 1 February 2024)

For all senders to personal Gmail accounts, Google's sender guidelines require:

SPF or DKIM for your sending domains;
valid forward and reverse DNS (PTR) for sending domains or IPs;
TLS for transmission;
spam rates in Postmaster Tools kept below 0.3%;
properly formatted messages (RFC 5322) and no impersonation of Gmail From: headers.

For senders of more than 5,000 messages a day to Gmail accounts, add:

both SPF and DKIM;
DMARC, where the policy can be set to none;
From: domain aligned with SPF or DKIM;
one-click unsubscribe for marketing and subscribed messages, plus a visible unsubscribe link in the body.

Google recommends staying below a 0.10% spam rate and never reaching 0.30%. Unauthenticated messages may be marked as spam or rejected with a 5.7.26 error.

Yahoo

Yahoo's Sender Hub sets almost the same rules. All senders need SPF or DKIM at minimum, a spam rate under 0.3%, valid forward and reverse DNS, and RFC compliance. Bulk senders need SPF and DKIM, a DMARC policy of at least p=none that passes, alignment with the From: domain, one-click unsubscribe (RFC 8058 POST method recommended) and unsubscribes honored within 2 days.

Microsoft Outlook.com (since 5 May 2025)

For domains sending more than 5,000 emails per day to Outlook.com, Hotmail and Live addresses, Microsoft requires SPF to pass, DKIM to pass, and DMARC of at least p=none aligned with SPF or DKIM. Its April 2025 update says non-compliant messages are rejected with the error "550; 5.7.515 Access denied, sending domain does not meet the required authentication level."

Do these apply to a small business? The strictest rules are for high-volume senders, but every sender must authenticate, and filters treat unauthenticated mail with suspicion regardless of volume. Setting up all three is the sensible baseline.

Setup steps

List every service that sends as your domain. Mailbox provider, website forms, booking system, accounting/invoicing, CRM, newsletter tool, help desk. Ask around; someone always forgot one.
Create or fix the SPF record. Merge everything into a single TXT record at the root of your domain. End with ~all (soft fail) while testing.
Turn on DKIM for each service. In each tool's domain settings, copy the DKIM records into DNS and click verify. Use your own domain for signing where the service allows it.
Publish DMARC at p=none with reporting. Add a TXT record at _dmarc.yourdomain.com with p=none and a rua address. A dedicated mailbox or a DMARC report service keeps the XML reports manageable.
Read reports for 2 to 4 weeks. Find any legitimate source that fails SPF, DKIM or alignment and fix it.
Move to p=quarantine. Once legitimate mail passes consistently, change the policy. You can phase in with pct= (for example, pct=25) to apply it to part of the failing mail first.
Consider p=reject. After a stable period at quarantine, reject gives the strongest protection against spoofing of your domain.
Add one-click unsubscribe to marketing mail if your tool doesn't do it already, and keep complaint rates low.

A rollout timeline that works for most small firms

Week	Policy	Focus
1	p=none	SPF and DKIM for all senders, reports flowing
2–4	p=none	Fix failing legitimate sources
5–8	p=quarantine (pct=25 → 100)	Watch for complaints about missing mail
9+	p=reject (optional)	Keep monitoring reports

Checking tools

Gmail's "Show original" on any message you sent displays SPF, DKIM and DMARC results. Quick and free.
Google Admin Toolbox, which Google points to for checking domain settings.
Google Postmaster Tools shows your spam rate and authentication status for mail to Gmail users.
Yahoo's Complaint Feedback Loop reports complaints from Yahoo users so you can clean your list.
DMARC aggregate reports reveal every service sending as your domain, including ones you didn't know about.
DNS lookup tools confirm the records are published exactly as intended, without typos or duplicate SPF records.

FAQ

Why do my emails still go to spam after setting this up?

Authentication proves identity; it doesn't guarantee inbox placement. Content, complaint rates, sending to old or purchased lists, and a sudden jump in volume all affect it.

Can I jump straight to p=reject?

You can, but you risk blocking your own invoices or form notifications from a service you forgot. Start with p=none and read the reports first.

Do I need DMARC if I only send a few emails a day?

The bulk-sender rules don't strictly require it, but it protects your domain from impersonation and helps filters trust your mail. It's a single DNS record.

What happens if I have two SPF records?

SPF evaluation fails. Merge them into one record.

If your quotes or invoices keep vanishing into spam folders, send us your domain and we'll check the records.