northstage

← All guides

Guide

Why your email lands in spam, and how to fix it in three DNS records

Mail from your own domain needs SPF, DKIM and DMARC so receivers can trust it. How to read the result in Gmail, what each record does and how to set them up step by step.

Last updated:

The short answer

Mail from your own domain needs three DNS records so receiving servers can trust it. SPF lists who may send for your domain. DKIM adds a signature that shows the message was not changed on the way. DMARC says what to do when those checks fail and sends you reports. Gmail and Yahoo both ask for them, and a missing or wrong record is a common reason mail is filtered or rejected. You can see the result yourself in about ten minutes: send a test to a Gmail address, open Show original and read the SPF, DKIM and DMARC lines.

In this guide

Who this is for

You send mail from your own domain: contact form notifications, invoices, a newsletter, or a mailbox at a hosting or Microsoft 365 provider. Some of it lands in spam, bounces, or someone tells you they received a message “from you” that you never sent. This guide shows how to read what the receiving side sees and how to fix the usual causes.

You do not need to be technical to run the check. Changing DNS records may need whoever manages your domain.

What the three records do

  • SPF is a list, published in your DNS, of the servers and services that may send mail for your domain.
  • DKIM is a digital signature. Your sending service signs each message and publishes the matching key in your DNS, so the receiver can check that the message is from that domain and was not changed.
  • DMARC tells receivers what to do when SPF and DKIM do not match the address in the From line (nothing, quarantine or reject), and where to send reports about it. For DMARC to pass, the domain that passed SPF or DKIM must align with the domain in the From line.

Gmail asks every sender to have SPF or DKIM. Senders of large volumes (Gmail names about 5,000 messages a day) need SPF, DKIM and DMARC, and a DMARC policy of none is allowed. Yahoo asks for the same, recommends a reporting address and a DKIM key of at least 1024 bits (Gmail sender requirements, Yahoo sender best practices).

How to tell which cause applies

  1. Send a test message from the address you use to a Gmail address you own.
  2. Open it, choose the three dots and Show original. Near the top you see SPF, DKIM and DMARC, each with PASS or FAIL.
  3. SPF fails: the service that sent the message is missing from your SPF record, or your domain has more than one SPF record. The standard allows only one SPF record per domain (RFC 7208), and an SPF check may trigger at most 10 DNS lookups, so a long chain of “include” entries can fail too.
  4. DKIM fails: the signing key was never added at your DNS, or it was added for a different domain than the one in the From line.
  5. DMARC is missing or not aligned: no DMARC record exists, or the From domain differs from the domain that passed SPF or DKIM. This is typical when a form tool or invoicing service sends in your name without being set up for your domain.
  6. If Gmail rejects a message, the bounce text carries a code that names the cause: 4.7.27 SPF, 4.7.30 DKIM, 4.7.31 no DMARC, 4.7.32 not aligned.

The fix, step by step

  1. List every service that sends mail as your domain. Mailbox provider, website form, invoicing, newsletter, booking tool, support desk. Ask each team member where they send from.
  2. SPF. Publish one TXT record for the domain that includes every service from your list. Each service documents the exact entry to add.
  3. DKIM. In each service, switch on signing for your domain and add the key it gives you to your DNS.
  4. DMARC. Start with v=DMARC1; p=none; rua=mailto:reports@your-domain as a TXT record on _dmarc.your-domain. This changes nothing about delivery, it only sends you reports.
  5. Read the reports for two to four weeks. They show who sends mail as your domain. Fix every legitimate sender that fails, and note the ones you do not recognise.
  6. Tighten step by step. Once legitimate mail passes, move from none to quarantine, and later to reject if you want spoofed mail blocked. Do it only when the reports are clean.
  7. Test again after every change and read the three lines again.

Use a dedicated mailbox for reports, not your own inbox. They arrive as many machine-readable files.

A ten-minute self-check

  • Send a test to a Gmail address and open Show original.
  • Do SPF, DKIM and DMARC all say PASS?
  • Is there exactly one SPF record on your domain?
  • Does every service that sends in your name appear in your list?
  • Does a DMARC record exist, with a reporting address you actually read?

When to get help

Ask someone experienced if:

  • several services send as your domain and the records keep conflicting
  • the reports show senders you do not recognise
  • you want to move to an enforcing policy without losing legitimate mail
  • you moved mail between providers and mail now disappears

We look at your records with you in a free 30-minute video call and name what to change: book a call.

Want a hand with it?

You can do all of this yourself. If you would rather hand it over, book the free 30-minute video call and bring the address of the page with the form and what you saw in your test. Or just send a message.

Book a video callSend a message