Why Do Your Emails Land in Spam? A Guide to SPF, DKIM and DMARC

You send a quote or a first email to a potential customer and hear nothing back. Maybe they weren't interested. But it may also be that the email never reached the inbox. It was filtered out as spam, and neither you nor the recipient noticed.

A common cause is that the domain lacks proper email authentication. Three technical settings, SPF, DKIM and DMARC, help the recipient's mail server decide whether an email really comes from you. If they are missing or set up incorrectly, it gets harder for your emails to get through. In this guide we explain what the three do, how to check your own domain and which mistakes are most common.

Why is email authentication needed?

Email was originally built without any way to verify the sender. In principle, anyone can type any address into the "From" field. That is how phishing and fraud emails work. To protect their users, the major email providers run their own checks on every incoming message. If the sender cannot show that an email is genuine, the risk grows that it ends up in spam or is rejected outright.

SPF, DKIM and DMARC are the three tools used for that check. All three are published as records in your domain's DNS, the same place where you manage the settings for your website and email.

SPF: which servers may send for your domain?

SPF (Sender Policy Framework) is a text record in DNS that lists which servers and services are allowed to send email in your domain's name. When an email arrives, the recipient's server looks at which server sent it and compares that with the list. If the server is on it, the check passes.

An SPF record might look something like this: v=spf1 include:_spf.google.com ~all. It says that Google's servers may send for the domain and that email from other servers should be treated with suspicion.

Common SPF mistakes

• Multiple SPF records. A domain may have only one SPF record. If there are two, the result is an error and the check fails.
• Forgotten services. Many companies send email from more systems than they realize: CRM, newsletter tools, invoicing software and support systems. If they are missing from the SPF record, their emails can fail the check.
• Too many lookups. Each "include" requires further DNS lookups, and the standard allows a maximum of ten. If the list gets too long, SPF stops working.

DKIM: a digital signature on every email

DKIM (DomainKeys Identified Mail) adds a digital signature to every email sent. The signature is created with a private key that only your email service has access to. The public key sits in your DNS, and with it the recipient can verify two things: that the email really comes from your domain and that the content has not been altered along the way.

DKIM is usually activated in the admin panel of your email provider, which then gives you a record to add to your DNS.

Common DKIM mistakes

• DKIM is enabled for the main mailbox but not for other services that send in the domain's name.
• The service signs with its own domain instead of yours, which means the signature does not help your domain in the DMARC check.
• The record was entered with the wrong name or was cut off when it was pasted into DNS.

DMARC: the rule that ties it all together

DMARC builds on SPF and DKIM. It does two things. First, it requires that the domain in the "From" field, the one the recipient sees, matches the domain that passed SPF or DKIM. Second, it tells the recipient what to do with email that fails the check.

The DMARC record is published at the address _dmarc followed by your domain and might look like this: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The value after "p" is the policy:

• none: do nothing in particular, but send reports.
• quarantine: put email that fails the check in the spam folder.
• reject: reject it outright.

Start cautiously and tighten step by step

It is wise to start with p=none and an address for reports. The reports show which servers send email in your domain's name. You will often find services you had forgotten about. Once all legitimate email passes the check, you can move on to quarantine and eventually reject. If you go straight to the strictest level, you risk blocking your own invoices or newsletters.

How to check your own domain

1. List every system that sends email. Think broadly: email, CRM, marketing tools, accounting systems, booking systems and web forms.
2. Look at your DNS records. Log in with whoever manages your domain or use a DNS lookup tool. Look for a TXT record starting with v=spf1, DKIM records for your services and a record at _dmarc.
3. Read the headers of a sent email. Send an email to your own address with a different provider and open the full header information. Under "Authentication-Results" you can see whether SPF, DKIM and DMARC returned a pass.
4. Follow up on the reports. If you have set up DMARC with reports, go through them after a few weeks and fix whatever does not add up.

Authentication is the foundation, not the whole solution

Correctly configured SPF, DKIM and DMARC are a requirement, but they do not guarantee that your emails reach the inbox. Email providers also take the sender's behavior into account. Many emails in a short time from a new mailbox, many bounces from addresses that do not exist and recipients who mark your emails as spam all damage trust.

That is why at ModoLeads we verify every email address before it is used, send few emails per mailbox per day and use dedicated domains that have been warmed up in advance. Sending is never done from the customer's domain, so their regular email is not affected. Above all, a relevant email to the right person is the best protection against the spam filter.

Want to know how your domain looks?

If you are unsure how your own domain is set up, you can work through the steps above yourself. You can also book a free 30-minute call with ModoLeads, where among other things we check SPF, DKIM and DMARC for your email domain. Then you will know whether your own emails risk ending up in spam, and what needs to be done about it.

Frequently asked questions

Why do my emails end up in spam?

A common cause is missing or incorrect email authentication. SPF, DKIM and DMARC help the recipient's mail server decide whether an email really comes from you. Sender behavior also matters, such as many emails in a short time from a new mailbox, many bounces and recipients marking your emails as spam.

What is the difference between SPF, DKIM and DMARC?

SPF lists which servers may send email for your domain. DKIM adds a digital signature that shows the email comes from your domain and has not been altered. DMARC requires that the domain in the "From" field matches the one that passed SPF or DKIM, and tells the recipient what to do with email that fails.

How do I check whether my domain is set up correctly?

List all systems that send email, then look at your DNS records for an SPF record, DKIM records and a record at _dmarc. Send an email to an address with another provider and check "Authentication-Results" in the full headers to see whether SPF, DKIM and DMARC passed. If you use DMARC reports, review them after a few weeks.