SPF, DKIM and DMARC: why your business emails land in spam
If customers say your emails end up in their spam folder, the cause is often three DNS records. Here is what they do and how to check them.
FOYEM Editorial Team
Foyem Information Technology Limited
6 min read
Few things undermine a marketing campaign — or a quote you have just sent — like an email that never reaches the inbox. Mailbox providers decide where messages go based on many signals, but one of the most important is simple: can they verify the email really came from you?
That verification relies on three DNS records: SPF, DKIM and DMARC.
SPF: who is allowed to send
A Sender Policy Framework record lists the servers allowed to send email for your domain — for example your email host and your newsletter platform. When a message arrives from a server that is not on the list, receiving providers treat it with suspicion.
A common mistake is adding a new sending tool (a CRM, a booking system, a newsletter service) without updating SPF. Another is publishing more than one SPF record, which invalidates them all.
DKIM: a tamper-proof signature
DomainKeys Identified Mail adds a cryptographic signature to each email. The public key is published in your DNS, so receivers can confirm the message was sent by an authorised system and was not altered along the way. Each sending service usually provides its own DKIM record to add.
DMARC: the policy that ties it together
DMARC tells receivers what to do when a message fails SPF and DKIM checks — do nothing, send it to spam, or reject it — and where to send reports. Those reports show who is sending email using your domain, including services you forgot about and anyone attempting to impersonate you.
A sensible path is to start with a monitoring policy (p=none), review the reports, fix legitimate senders, then move gradually to quarantine and reject.
Beyond DNS
Authentication is the foundation, but deliverability also depends on behaviour:
- List hygiene — remove addresses that bounce and contacts who never engage.
- Sending practice — avoid sudden spikes in volume and send consistently.
- Content — clear subject lines, a balance of text and images, and a working unsubscribe link.
- Inbox placement testing — test campaigns before sending to the full list.
A quick checklist
- Do you have exactly one SPF record, and does it include every service that sends for you?
- Is DKIM enabled for your mailbox provider and each marketing tool?
- Is a DMARC record published, and is anyone reading the reports?
- Are bounces and unsubscribes removed automatically?
If any answer is "not sure", an email deliverability audit is a quick, inexpensive way to protect every message your business sends.