Why your business emails go to spam: SPF, DKIM and DMARC explained
What SPF, DKIM and DMARC are, what Google requires of senders, how to check your own domain and what to do first, in plain English.
By Logic NI3 min read
If your quotes, invoices or enquiry replies keep landing in spam, or customers say your emails never arrived, the cause is often missing or wrong authentication on your domain. This guide explains the three checks, what the big mailbox providers say, and what to do about it.
Why this matters
Anyone can put your name in the "from" line of an email. Mailbox providers therefore look for evidence that a message really came from the domain it claims. If they cannot find it, your genuine email is more likely to be treated as suspicious, and criminals can more easily pretend to be you.
What SPF, DKIM and DMARC do
The National Cyber Security Centre explains the three in its email security guidance:
| Check | What it does, in the NCSC's words | In plain terms |
|---|---|---|
| SPF | Lets you publish the IP addresses which should be trusted for your domain | A list of the servers allowed to send email for you |
| DKIM | Lets you cryptographically sign email you send, to show it is from your domain | A signature on each message that proves it was not forged or altered |
| DMARC | Lets you set a policy for how receiving servers should handle email which fails SPF or DKIM, and generates reports | Your instruction on what to do with failures, plus reports on who is sending as you |
All three are published as records in your domain's DNS settings. The NCSC adds that you should protect all of your organisation's domains, including where you use cloud email providers such as Google or Microsoft.
What Google requires
Google's email sender guidelines apply to anyone sending to Gmail accounts:
| Sender | Requirement |
|---|---|
| All senders | Set up SPF or DKIM for sending domains. Use TLS. Keep spam rates reported in Postmaster Tools low |
| Senders of more than 5,000 messages a day | SPF and DKIM, plus DMARC. The DMARC policy can be set to none |
| Bulk marketing senders | One-click unsubscribe and a clearly visible unsubscribe link |
Google also states that sending to personal Gmail accounts needs a DKIM key of 1024 bits or longer, and recommends 2048 bits if your provider supports it. Its overall advice is to always set up SPF, DKIM and DMARC for your domains, even if you send far fewer than 5,000 a day.
Other big providers publish similar rules for high-volume senders. If you send ordinary business email, the practical conclusion is the same: set up all three.
How to check your own domain
- Send a test message from your business address to a Gmail account, open it and choose "Show original". Gmail displays whether SPF, DKIM and DMARC passed.
- Ask your IT provider or email host which records exist for your domain.
- Look at your DNS settings for TXT records. SPF starts with v=spf1 and DMARC sits at _dmarc on your domain.
Common reasons it goes wrong
| Problem | What to do |
|---|---|
| No SPF, DKIM or DMARC at all | Add them through your email provider's setup instructions |
| Two SPF records | A domain should have one SPF record. Combine them |
| A newsletter or booking tool sending as you without being authorised | Add that service to your SPF and enable its DKIM signing |
| Your website form sends from your own address through the wrong server | Send through your email provider or a properly authenticated service |
| DMARC set to strict before everything is aligned | Start with a monitoring policy and move up once reports are clean |
| Spam complaints or a poor reputation | Authentication will not fix that. Send only to people who expect to hear from you |
A sensible order of work
- Set up SPF and DKIM through your email provider.
- Publish DMARC with a policy of none and an address to receive reports.
- Read the reports for a few weeks and add any legitimate sender that is failing.
- Tighten the policy when you are confident, for example to quarantine and later reject.
Changing DNS records by mistake can stop your email or website, so take care or ask someone experienced.
Where Logic NI fits
We manage DNS for websites we host and can add the records your email provider supplies, but we do not host or administer business mailboxes. See our website maintenance and managed support, or ask us.