Why your emails land in spam: SPF, DKIM and DMARC explained

If your invoices, quotes or newsletters keep ending up in spam, or a customer tells you they got a strange email “from you” that you never sent, the cause is often the same: your domain isn’t properly authenticated.

This used to be a nice-to-have. It isn’t anymore.

What changed

Starting in February 2024, Google and Yahoo began enforcing new rules for anyone sending large volumes of email to their users. Bulk senders, those sending around 5,000 or more messages a day to Gmail, must authenticate with SPF and DKIM, publish a DMARC policy, make unsubscribing easy and keep spam complaint rates low. In 2025 Microsoft introduced similar requirements for high-volume senders to Outlook.com and Hotmail addresses.

Even if you send far less than that, the mailbox providers are using the same signals to decide what to trust. Authenticated mail is more likely to reach the inbox, and unauthenticated mail is increasingly treated with suspicion.

The three records, in plain English

• SPF (Sender Policy Framework) is a published list of the servers allowed to send email for your domain, like Microsoft 365, Google Workspace, your newsletter tool and your invoicing system.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so the receiver can confirm it really came from you and wasn’t altered on the way.
• DMARC ties the two together. It tells receiving servers what to do when a message claiming to be from your domain fails those checks: monitor it, send it to spam, or reject it. It also sends you reports showing who’s sending email using your name.

Why it matters beyond deliverability

DMARC is also one of the best defenses against spoofing, where criminals send email that looks like it came from your domain. That’s the basis of a lot of invoice fraud and phishing aimed at your customers and vendors. A properly enforced DMARC policy makes it much harder for someone to impersonate you.

How to set it up safely

1. List everything that sends email as you. Your email provider, website forms, CRM, newsletter platform, invoicing and booking tools. Forgetting one is the most common cause of problems.
2. Publish SPF covering those services, and keep it within SPF’s lookup limits.
3. Turn on DKIM for each service that supports it. Most do, with a couple of DNS records.
4. Start DMARC in monitoring mode (p=none) and read the reports for a few weeks to find any legitimate senders you missed.
5. Tighten the policy to quarantine and then reject once you’re confident all your real email passes.

Done in that order, you get the protection without accidentally blocking your own invoices.

A quick check

If you’re not sure where you stand, it only takes a few minutes to look up your domain’s SPF, DKIM and DMARC records. If any are missing, or DMARC has been sitting at p=none for years, it’s worth fixing.

Requirements from mailbox providers change from time to time. Check Google’s, Yahoo’s and Microsoft’s current sender guidelines if you send email in volume.