Start a project

Why your business email goes to spam: SPF, DKIM and DMARC explained

By the Risen team · Updated · 7 min read · 6 sources

The short answer

Email from your domain is far more likely to reach the inbox when three DNS records are set up: SPF lists who may send for your domain, DKIM signs each message, and DMARC tells receiving servers what to do when a message fails those checks. Gmail requires SPF or DKIM from every sender, and all three from anyone sending 5,000 or more messages a day.

Key points

  • SPF, DKIM and DMARC are all DNS records on your domain. They cost nothing to add.
  • Every service that sends email as you (your mailbox, website forms, invoicing, newsletters) must be covered.
  • Start DMARC at p=none, read the reports, then tighten to quarantine or reject.
  • Using a free address like yourbusiness@gmail.com means you can't authenticate your own domain at all.

Why authentication matters

Anyone can put any address in the "From" line of an email. That's how most phishing works. To decide whether a message really came from your business, Gmail, Outlook and Yahoo check records published in your domain's DNS. If the records are missing or don't match, your genuine email looks just like a forgery and is more likely to land in spam.

SPF: who is allowed to send

SPF (Sender Policy Framework) is a single TXT record listing the servers allowed to send email for your domain. Google describes it as a way to help prevent your outgoing email "from being marked as spam by receiving email servers."[1]

A Google Workspace domain's record looks like this:

v=spf1 include:_spf.google.com ~all

The trap: a domain can have only one SPF record. If your website, invoicing software or newsletter tool also sends as you, its include: belongs in that same record. It shouldn't be added as a second record.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The public half of the key sits in your DNS, so receiving servers can confirm the message wasn't altered and really came from an authorized sender.[2] Your email provider generates the key, and you paste it into DNS as a TXT record. Gmail recommends 2048-bit keys.[4]

DMARC: what to do when checks fail

DMARC is a TXT record at _dmarc.yourdomain.com. It "tells receiving email servers what action to take" when a message fails SPF or DKIM, and where to send reports.[3] It has three policies:

  • p=none: monitor only. Deliver as usual, but send reports.
  • p=quarantine: send failing messages to spam.
  • p=reject: refuse failing messages.

Google suggests starting at none, reviewing the reports (the rua address), and tightening once every legitimate service passes.[3]

What Gmail and Yahoo require

Since February 2024, Gmail's rules for everyone sending to Gmail addresses include SPF or DKIM, valid forward and reverse DNS, a secure (TLS) connection, and a spam complaint rate below 0.3%. Senders of 5,000 or more messages a day to Gmail must have SPF, DKIM and DMARC, with the From domain aligned, plus one-click unsubscribe for marketing mail.[4] Yahoo enforces matching rules for bulk senders.[5]

Most small businesses aren't bulk senders. But the same records are what keep everyday email out of spam, so set them all up.

A quick checklist

  1. Use an address on your own domain (you@yourbusiness.com), not a free Gmail or Yahoo address.
  2. List every service that sends email as you: your mailbox, website forms, invoicing, scheduling, newsletters.
  3. Make sure one SPF record covers all of them.
  4. Turn on DKIM in each service that supports it.
  5. Add DMARC at p=none with a report address, then tighten over a few weeks.

If you send marketing email

The federal CAN-SPAM Act applies to commercial email. It bans misleading headers and subject lines, requires a valid postal address and a working opt-out, and says opt-outs must be honored within 10 business days. You remain responsible even if a vendor sends the email for you, and penalties currently exceed $50,000 per violating email.[6]

Common questions

Why are my business emails going to spam?

The most common cause is missing or incomplete SPF, DKIM or DMARC records, especially when a second service (a website form, invoicing tool or newsletter platform) sends email as your domain without being included. Spam complaints and sending from a new domain also play a part.

Do I need DMARC if I only send a few emails a day?

Gmail only requires DMARC from bulk senders, but it is still worth having. It stops others from easily faking your domain, and its reports show you every service sending as you.

What DMARC policy should I use?

Google suggests starting at p=none, which only monitors. Once the reports show all your real email passing, move to quarantine (send failures to spam) and then reject.

Does a contact form on my website affect my email?

It can. If your form sends messages from your domain through a service that isn't in your SPF record or signed with DKIM, those messages may fail DMARC and be rejected or marked as spam.

Sources

  1. Google Workspace Admin Help. Set up SPF
  2. Google Workspace Admin Help. Set up DKIM
  3. Google Workspace Admin Help. Set up DMARC
  4. Gmail Help. Email sender guidelines
  5. Yahoo Sender Hub. Sender best practices
  6. Federal Trade Commission. CAN-SPAM Act: a compliance guide for business

This guide is general information for small business owners, not legal advice. We check it against the sources above and update it when they change. Spot something out of date? Email hello@risendesign.app.