Business emails going to spam: SPF, DKIM and DMARC

The test to do now

Send one of your emails to a Gmail address. Open the message, then the three dots and "Show original". At the top Gmail lists SPF, DKIM and DMARC, each with PASS or FAIL. If one is missing or shows FAIL, you know where to start.

What Gmail asks for

Since 2024 Google has published requirements for anyone sending to personal Gmail addresses:

• SPF or DKIM on the sending domain;
• a valid PTR record on the server's IP address, meaning reverse DNS;
• an encrypted TLS connection;
• spam reports below 0.3%.

Anyone sending more than 5,000 messages a day needs all three records, alignment with the sender's domain and, for newsletters, one-click unsubscribe. Below that threshold it still pays to have them all: they take an hour of work.

The causes I find most often

• The SPF record doesn't include every service that sends: mail, business software, newsletter, online shop. Or there are two SPF records, which makes the check fail.
• The website contact form sends using the visitor's address as From. The message comes from a domain that doesn't authorise your server, so it is forged by definition.
• The site sends with PHP's mail() function from the web server. It should use authenticated SMTP.
• The shared server is on a blacklist because of another customer on the same hosting.
• A mailbox was compromised and sent spam: the domain's reputation stays low for weeks.
• The domain was changed or the hosting moved, and the old records were left in place.

What I do

1. I read the domain's records and the headers of a real message.
2. I list who sends in your name. A service nobody remembered often turns up.
3. I write SPF, turn on DKIM for each service and set DMARC to observe, with p=none.
4. I fix the website form, if needed, so that it sends over SMTP.
5. After a few weeks I read the DMARC reports and tighten the rule, so nobody can send pretending to be you.

Your mail can also live on a server I manage: the plans are on the Servers and hosting page. If a message from you contains strange links or the mailbox sends on its own, see the hacked website page too.

Frequently asked questions

What are SPF, DKIM and DMARC, in two lines?

SPF says which servers may send for your domain. DKIM puts a signature on each message. DMARC tells the recipient what to do if those checks fail, and sends you a report.

Will email stop while you fix the records?

No, if it is done in the right order. First I list every service sending in your name, then I set DMARC to observation only and tighten it once the reports are clean.

We use Microsoft 365 or Google Workspace. Do we still need this?

Yes. They do the sending, but the records in your domain's DNS are yours to add, and DKIM often has to be turned on by hand in the admin panel. It is one of the gaps I find most often.

Is that enough to get out of spam?

It removes the technical cause. If the server is on a blacklist, a mailbox has been compromised or many recipients mark your messages as spam, that needs fixing too.

Read more

• The service: Servers and hosting
• More pages like this: Websites with a problem