Fix Email Going to Spam (SPF, DKIM & DMARC Explained)
email goes to spamnot deliveredSPF/DKIM failIf your email keeps landing in spam, it's almost always missing authentication. Three DNS records — SPF, DKIM and DMARC — prove your mail is genuine. Set all three and deliverability jumps.
Why mail goes to spam
Mail providers (Gmail, Outlook) now require proof that a message really came from your domain. Without it, they assume spoofing and filter you. SPF, DKIM and DMARC are that proof.
SPF — who is allowed to send
An SPF record is a TXT record listing the servers allowed to send mail for your domain. One record only, ending in ~all:
Type Name Value
TXT @ "v=spf1 a mx include:_spf.google.com ~all"Multiple SPF records break SPF entirely. If you use several senders (your host + Google + a newsletter tool), merge them into a single record with multiple include: entries.
DKIM — a tamper-proof signature
DKIM adds a cryptographic signature to every message, which the receiver verifies against a public key in your DNS. Your host or mail provider generates the key and the TXT record (usually at a selector like default._domainkey). Enable DKIM in your mail panel and publish the record it gives you.
DMARC — the policy that ties it together
DMARC tells receivers what to do when SPF/DKIM fail, and where to send reports. Start in monitoring mode (p=none) so nothing legitimate is blocked while you check reports:
Type Name Value
TXT _dmarc "v=DMARC1; p=none; rua=mailto:you@example.com; fo=1"Once reports confirm your real mail passes, tighten to p=quarantine then p=reject.
The clean checklist
- Publish one SPF TXT record covering all your senders.
- Enable DKIM in your mail panel and publish its TXT record.
- Add a DMARC record starting at
p=none. - Test with a tool (send to a mail-tester and check all three pass).
- Tighten DMARC to quarantine/reject once everything passes.
SPF says who can send, DKIM proves it wasn't tampered with, DMARC ties them together. Inboxes want all three.
Other reasons email keeps going to spam besides SPF/DKIM/DMARC
- Sending from a brand-new domain or IP with no sending history yet — reputation is built gradually, not instantly.
- A mismatched "From" domain versus the domain your SPF/DKIM records are actually published on.
- Spammy subject lines, excessive links, or a poor reputation inherited from a shared hosting IP.
- A missing PTR (reverse DNS) record that doesn't match your sending server's hostname.
- No
List-Unsubscribeheader on bulk or marketing mail — inbox providers weigh this heavily now.
How to prevent your email going to spam long-term
Authentication (SPF/DKIM/DMARC) gets you in the door, but staying out of spam also means watching your sender reputation over time: monitor DMARC aggregate reports for unexpected failures, keep bounce and complaint rates low, warm up new sending domains gradually instead of blasting volume on day one, and never buy or import unverified mailing lists.
Related DNS and hosting guides
Email authentication depends on DNS being set up correctly first — see how to point a domain to your server if you're still configuring the domain. If the domain doesn't resolve at all, check DNS_PROBE_FINISHED_NXDOMAIN. For the site behind the domain, see how to secure a WordPress website.
Hosting with proper mail setup
Our web hosting includes easy DKIM/SPF setup and a clean mail panel, on a protected network.
Frequently asked questions
Why do my emails go to spam even though they're legitimate?
Almost always missing or broken authentication. Without valid SPF, DKIM and DMARC records, Gmail and Outlook can't verify your domain and default to the spam folder. Set all three correctly.
Can I have two SPF records?
No — a domain must have exactly one SPF record. Two or more cause a permerror and SPF fails completely. Combine all your senders into a single record with multiple include: statements.
What DMARC policy should I start with?
Start with p=none (monitor only) so you can read the reports without blocking real mail. Once you confirm your legitimate mail passes SPF/DKIM, move to p=quarantine and then p=reject.
What is a PTR (reverse DNS) record and does it affect spam filtering?
A PTR record maps your sending IP back to a hostname. Many mail providers check that it matches your sending domain, and a missing or mismatched PTR record hurts deliverability even with SPF/DKIM/DMARC set up correctly.
How long does it take for SPF/DKIM/DMARC changes to improve deliverability?
DNS changes themselves propagate within hours, but sender reputation with providers like Gmail can take days to weeks to fully reflect the improvement, especially for a domain with an existing poor reputation.
Can shared hosting hurt my email deliverability?
Yes — on shared IPs, another tenant's spam can damage the shared sending reputation for everyone on that IP, regardless of your own SPF/DKIM/DMARC setup. A dedicated sending IP avoids this.
What is DMARC alignment?
It means the domain in your "From" header matches (aligns with) the domain authenticated by SPF and/or DKIM. Even with valid SPF and DKIM, DMARC fails if neither aligns with the visible From address.
Related articles
Fix "500 Internal Server Error" on Your Website
A 500 error on your site? The usual causes — .htaccess, file permissions, PHP — and how to fix them.
Read fix Web HostingHow to Point a Domain to Your Server (DNS A Record)
How to point a domain at your server with an A record — and why it doesn't work instantly.
Read fix Web HostingFix "502 Bad Gateway" on Your Website
A 502 Bad Gateway? It's the backend (usually PHP-FPM) failing — every cause and how to fix it.
Read fix
