Fix emails landing in spam: SPF, DKIM and DMARC set up properly

Most spam-folder problems for small businesses come from sending authentication that is missing, duplicated or misaligned, and from sending to people who did not expect the mail. I check the DNS records, the sending tools and the headers of real messages, then fix what is actually wrong rather than changing everything at once.

What I check, in order

1. Who sends as your domain. Your mail provider, a newsletter tool, a CRM, an invoicing system, a website contact form. Each needs to be authorised.
2. SPF. A DNS TXT record listing the servers allowed to send for your domain. Common faults: two SPF records instead of one, too many lookups, or a forgotten service.
3. DKIM. A signature added to each message, verified against a public key in DNS. Each sending service needs its own key set up on your domain.
4. DMARC. A DNS record that tells receivers what to do when mail fails checks and where to send reports. I start with a monitoring policy, read the reports, then move toward enforcement once every legitimate sender passes.
5. Alignment. For DMARC to pass, the visible From domain must match the domain that passed SPF or DKIM. This is the most common hidden failure when a tool sends “on your behalf”.
6. Headers on a real message. I read the authentication results in a delivered test, not just the DNS records.

What Google requires

According to Google’s sender guidelines, the rules depend on volume:

• All senders to personal Gmail accounts: SPF or DKIM, valid forward and reverse DNS for sending domains or IPs, TLS, messages in RFC 5322 format, and a spam rate in Postmaster Tools below 0.3% (Google recommends staying under 0.10%).
• Bulk senders (more than 5,000 messages per day to Gmail): SPF, DKIM and DMARC, with the From domain aligned to the SPF or DKIM domain. Marketing and subscribed messages must support one-click unsubscribe, with a visible unsubscribe link in the body, using the List-Unsubscribe and List-Unsubscribe-Post headers. The DMARC policy may be set to none.

Yahoo publishes its own sender requirements for bulk senders, so check its sender hub for current wording. I did not verify Yahoo’s thresholds against its own pages for this page, so I do not state them here.

What authentication does not fix

If your list contains old or purchased addresses, if people mark your mail as spam, or if a new domain suddenly sends a high volume, correct DNS will not rescue placement. For those I advise cleaning the list, sending to people who asked for it, adding a clear unsubscribe, and ramping volume slowly.

What I need from you

• Access to DNS (or a person who can add records on my instructions).
• A list of every tool that sends email as your domain.
• A few example emails that went to spam, with headers if you can export them.
• Access to Google Postmaster Tools for your domain, if you send in volume.

I deliver a record-by-record change list, apply it with you, test with fresh messages, and note what to re-check whenever you add a new sending tool.

Sources

• Google, Email sender guidelines: https://support.google.com/a/answer/81126