Why do my emails end up in spam?
Whether another mail server drops your message into the inbox or the spam folder comes down to three records in DNS. They are called SPF, DKIM and DMARC.
What does that mean?
When you send an email, the recipient's server checks whether the message really came from you. It has three tools for that, and all three sit in your domain's DNS.
SPF is the list of servers allowed to send in your name. If the sending server is not on it, the message counts as suspect. DKIM is a signature: your mail server signs every message, and the recipient checks the signature against a key in your DNS. DMARC tells the recipient what to do when SPF or DKIM do not add up: let it through, put it in the spam folder, or turn it away.
Since 2024, Google and Microsoft have required SPF, DKIM and a DMARC record from anyone sending mail to their users regularly. Without those three, mail often stops arriving there altogether.
What can go wrong?
- SPF lists the old provider, but a different server has been sending since the move.
- The newsletter tool is missing from SPF. Invoices arrive, the newsletter does not.
- There are two SPF records. Two is one too many, and then neither of them counts.
- SPF ends on
?all. With that your domain says: do not take this too seriously. - DMARC is set to
p=none. The record reports, but it never steps in.
In short
SPF says who is allowed to send. DKIM proves nobody changed anything along the way. DMARC sets out what happens when a check fails.
How do you fix it?
All three records get set wherever your domain's nameservers point. Which provider
that is stands in the result above. The usual route: add the missing sender to SPF,
switch DKIM on at your mail provider and take over the record it shows you, then set
DMARC to p=none at first, read the reports for two weeks and raise it to
p=quarantine.
The terms one by one are in the glossary.
Questions that usually come up together:
