Emails Going to Spam? Set Up SPF, DKIM and DMARC Correctly

Quick fix: Your domain needs three DNS records. SPF lists every server allowed to send your mail. DKIM cryptographically signs each message. DMARC tells receivers what to do when a message fails those checks. Check what you have with dig, publish one combined SPF record, turn on DKIM in your email provider, and start DMARC at p=none with reporting.

Why this matters now

Since 2024, Google and Yahoo have required authentication for mail sent to their users. Every sender needs SPF or DKIM, and bulk senders need SPF, DKIM and DMARC. Mail without proper authentication increasingly lands in spam or is rejected outright, and that includes the contact-form notifications and order emails your website sends.

Step 1: See what you have now

From any Linux or macOS terminal (on Windows, use nslookup -type=TXT), replacing example.com with your domain:

# SPF (look for the record starting v=spf1)
dig +short TXT example.com

# DMARC
dig +short TXT _dmarc.example.com

# DKIM: the selector depends on your provider ("google" for Google Workspace)
dig +short TXT google._domainkey.example.com

Step 2: Fix SPF

SPF is a single TXT record on your domain that lists every service allowed to send mail as you. Common include values:

Provider	Add to your SPF record
Google Workspace	`include:_spf.google.com`
Microsoft 365	`include:spf.protection.outlook.com`
Your web server (contact forms)	`ip4:` followed by the server's IP address

A combined record looks like this:

v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all

Have only one SPF record. Two separate v=spf1 records make SPF fail entirely, so merge them into one. Also keep the total number of DNS lookups (each include, a and mx) at 10 or fewer, or receivers will treat SPF as broken.

Step 3: Turn on DKIM

DKIM keys are generated by whoever sends your mail. You publish the public key in DNS:

Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email. Generate a key, add the TXT record it gives you, then click Start authentication.
Microsoft 365: the Microsoft Defender portal's DKIM settings give you two CNAME records (selector1 and selector2) to publish, after which you enable signing.
cPanel servers: the Email Deliverability tool shows the DKIM and SPF records it recommends for each domain and can install them if the server hosts your DNS.

Step 4: Publish DMARC

Start in monitoring mode, so nothing legitimate gets blocked while you confirm everything passes:

Name:  _dmarc.example.com
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:[email protected]

The rua address receives daily reports showing who is sending mail as your domain and whether it passes. After a few weeks of clean reports, tighten the policy to p=quarantine and eventually p=reject. That stops others from spoofing your domain.

Step 5: Don't forget mail your website sends

Contact forms and online stores often send through the web server itself. Two common problems:

The web server's IP address isn't in your SPF record.
The message's hidden "envelope sender" is the server's own hostname rather than your domain, so the SPF check is made against the wrong domain. In PHP, pass -f [email protected] as the fifth argument to mail(), or better, send through an authenticated SMTP service.

Verify

Send a test message to a Gmail address.
In Gmail, open the message, click the three-dot menu and choose Show original.
You should see SPF: PASS, DKIM: PASS and DMARC: PASS near the top.

Repeat the test for each system that sends as your domain: your mailbox provider, your website, and your billing or marketing tools.

Email deliverability problems can be stubborn. If your messages still land in spam, talk to us. We untangle SPF, DKIM, DMARC and mail-server reputation issues regularly.