Why your emails land in spam: SPF, DKIM and DMARC explained

Fibvo editorial · 13 May 2026 · 5 min read

A client says they never received the quotation you sent on Monday. It was in their spam folder. The following week another client says the same about an invoice. Nothing in either email looked suspicious to you, but the receiving mail server could not confirm that the messages really came from your business. SPF, DKIM and DMARC are how it makes that check.

Why mail servers ask for proof

Anyone can type any address into the From line of an email. That is how phishing works: a message appears to come from your bank or your supplier when it was sent from somewhere else. Gmail, Outlook, Yahoo and company mail servers deal with this by checking records published in your domain's DNS, the same public settings that point your domain to your website.

Google and Yahoo have required bulk senders to use all three records since 2024, and Microsoft introduced similar requirements for Outlook addresses in 2025. Even if you send far fewer emails than those rules target, a domain without the records is easier to impersonate and gets less benefit of the doubt.

The three records in plain terms

• SPF (Sender Policy Framework) lists the services allowed to send email for your domain. If staff use Google Workspace or Microsoft 365 and marketing goes through a newsletter platform, both must be on the list. A domain can have only one SPF record, so each new service is added to the existing record rather than published as a second one. SPF also limits how many lookups a record can trigger, so a record crowded with services can fail without anyone noticing.
• DKIM (DomainKeys Identified Mail) is a digital signature. Your sending service signs each message with a private key, and the matching public key is published in your DNS. If a message was altered in transit or was never signed by your service, the check fails. Every service that sends as your domain needs its own DKIM set up.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when a message using your domain fails, and asks them to send you reports. It also checks alignment: the domain in the visible From address must match a domain that passed SPF or DKIM.

Alignment is the part owners tend to miss. A newsletter platform can pass SPF using its own domain while your company address sits in the From line. DMARC wants the passing domain to be yours, which is why platforms ask you to authenticate your domain by adding records they provide, instead of sending on your behalf with their own.

Moving DMARC from monitoring to enforcement

DMARC has three policy levels. Moving through them in order stops you blocking legitimate email you had forgotten about, such as invoices from accounting software, alerts from your website or messages from a CRM.

• Start with p=none and a reporting address. Nothing is blocked, and you begin receiving reports on every source sending as your domain.
• Read the reports for several weeks. They arrive as XML files, so use a DMARC report tool rather than opening them by hand. Set up SPF and DKIM for every legitimate source you find.
• Move to p=quarantine, which asks receivers to put failing messages in spam.
• When the reports show only legitimate senders, move to p=reject, which asks receivers to refuse failing messages.

The DMARC record is a TXT record at _dmarc followed by your domain. If nobody on your team manages DNS, ask whoever registered the domain, your IT vendor or an agency such as Fibvo to publish the records and go through the first reports with you.

Sender reputation comes from how people respond

Authentication proves your email is genuine. It does not make anyone want it. Mailbox providers also watch how recipients treat your messages over time: whether they open and reply, move them out of spam, delete them unread or report them as spam.

Authentication tells a mail server who you are; reputation tells it whether anyone wants to hear from you.

• Spam complaints do the most harm. Make the unsubscribe link easy to find, because a person who cannot find it presses the spam button instead. Gmail and Yahoo require bulk marketing email to offer one-click unsubscribe and to act on requests within two days.
• Repeated sends to addresses that do not exist suggest a list nobody maintains.
• Sudden jumps in volume look like a hacked account. Steady, predictable sending builds trust.
• Google Postmaster Tools is free and shows how Gmail sees your domain, including your spam complaint rate, once the domain is verified and you send enough mail to Gmail users for data to appear.

Warming up a new domain or platform

A domain with no sending history has no reputation to rely on. When you register a new domain, switch email platforms or start sending from a new subdomain such as news.yourcompany.com, receiving servers treat the first messages with caution. Sending to your whole list on the first day invites the spam folder.

• Authenticate first. SPF, DKIM and DMARC should be in place before the first send.
• Begin with the contacts most likely to welcome your email: customers and people who have clicked, replied or bought recently.
• Send small volumes and increase them gradually over several weeks, checking bounces and complaints at each step.
• Keep content, sending days and sending times consistent during this period, so any problem is easy to trace.
• If complaints or bounces rise, hold volume steady until they settle rather than pushing on.

---

Written by Fibvo — Bengaluru and Erode, India — working with clients in other time zones. Questions, or think we have it wrong? Tell us.