Stop Your Emails Landing in Spam: SPF, DKIM and DMARC

You send a quote to a new client. They never reply. A week later you find out it went straight to their spam folder.

Very often the cause is three missing records in your domain's settings: SPF, DKIM and DMARC. They tell Gmail, Outlook and Yahoo that mail claiming to come from your company really did. Without them, your mail looks like it could be fake, and big mail providers now treat it that way.

What the three records do, in plain words

SPF is a list of the servers allowed to send mail for your domain. "Mail from example.com may only come from these places."
DKIM adds a digital signature to every message, so the receiver can check nothing was changed on the way.
DMARC tells receivers what to do when a message fails those checks, and sends you reports about who is sending mail in your name.

Why this matters more now

Google (Gmail): since February 2024, every sender needs SPF or DKIM. Anyone sending more than 5,000 messages a day to Gmail needs SPF, DKIM and DMARC. Since November 2025 Gmail has been rejecting more mail that breaks these rules.
Yahoo: the same basic rules for all senders, and all three records for bulk senders.
Outlook.com (Microsoft): since 5 May 2025, domains sending more than 5,000 messages a day must pass SPF and DKIM and publish DMARC.

Even if you send far fewer messages, setting all three is the safest choice.

Step 1: List everything that sends mail as you

Before you touch any record, write down every system that sends mail from your domain:

your mailbox provider (Google Workspace, Microsoft 365, or your hosting's mail server)
your website (contact forms, store order emails)
newsletter or marketing tools
invoicing or CRM systems that email clients

Each one must be covered, or its mail will start failing.

Step 2: Publish one SPF record

SPF is a TXT record on your domain. A simple example for a domain that uses Google Workspace:

v=spf1 include:_spf.google.com ~all

For Microsoft 365 the include is include:spf.protection.outlook.com. Your hosting provider or mail tool will tell you its own include.

Two rules people break all the time:

Only one SPF record per domain. Two SPF records cause an error and both stop working. Combine everything into one line.
No more than 10 DNS lookups. Every include counts. Too many includes also cause an error.

Step 3: Turn on DKIM

DKIM is switched on inside your mail service, which then gives you a record to add to your domain:

Google Workspace: Admin console, Apps, Google Workspace, Gmail, Authenticate email.
Microsoft 365: Microsoft Defender portal, email authentication settings, DKIM.
cPanel hosting: Email, Email Deliverability.

Add the record it gives you, wait for it to show as active, then send yourself a test message.

Step 4: Start DMARC in "watch" mode

DMARC is a TXT record at _dmarc.yourdomain. Start with a policy that only watches:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Use a real mailbox on your own domain in place of dmarc@example.com. Reports will arrive there. After two to four weeks, when the reports show only your real systems sending mail, move to p=quarantine, then later to p=reject. That last step is what stops strangers sending fake mail in your company's name.

Step 5: Check your work

MxToolbox has free SPF, DKIM and DMARC lookups and a blacklist check.
In Gmail, open a message you sent, choose "Show original", and look for SPF, DKIM and DMARC: PASS.

Common mistakes

A second SPF record added by a website plugin or a new tool.
Moving to p=reject before checking the reports, so a real system gets blocked.
Forgetting the website's contact form, which often sends mail from a different server.

In short: SPF says who may send, DKIM proves the message was not changed, and DMARC says what to do with fakes. Set all three, check them once, and your quotes stop disappearing.

Want someone to check your domain? Book a free 30-minute consultation and we will look at your records together. Want the next guide in your inbox? Use the newsletter box below.

Sources: Google email sender guidelines · Yahoo sender best practices · Outlook requirements for high-volume senders · RFC 7208 (SPF) · RFC 9989 (DMARC). Checked 11 October 2026.