Emails going to spam? Check SPF, DKIM and DMARC in this order

Step 1: Read the headers of a message that went to spam

Send a test message to a Gmail or Outlook address you control. If it lands in spam, open it and copy the full headers (in Gmail: the three dots, then Show original). Paste them into the Email Header Analyzer.

Look at three results near the top: SPF, DKIM and DMARC. They tell you exactly where to start:

Step 2: Fix SPF

SPF lists the servers allowed to send mail for your domain. It fails when you send through a service that is not on the list, which often happens after adding a newsletter tool or a contact form plugin.

1. Run the SPF Checker on your domain.
2. If there is no record, or the sending service is missing, build a new one with the SPF Generator.
3. Make sure there is only one SPF record. Two records starting with v=spf1 make SPF fail for everyone.
4. Keep DNS-lookup mechanisms within SPF's limit of at most 10. The checker includes nested include and redirect terms; it is not simply a count of every DNS packet.

Step 3: Turn on DKIM for every sending service

DKIM signs selected message headers and content. Forwarding can preserve the signature when those signed parts remain unchanged; a mailing list or intermediary that changes them can invalidate it. A published key alone does not prove that an actual message was signed correctly.

1. In each service that sends as your domain (Google Workspace, Microsoft 365, your newsletter tool, your shop), find the DKIM or "domain authentication" setting. It gives you one or more DNS records to add, usually CNAME or TXT records with a name like selector._domainkey.
2. Add the records exactly as given, then press the verify button in the service.
3. Check the key with the DKIM Checker. The selector is the part before ._domainkey, or look for s= in the DKIM-Signature header of a message.

Step 4: Make sure the domains line up

DMARC requires a passing SPF or DKIM identity aligned with the visible From domain. Strict alignment requires an exact domain match. Relaxed alignment can allow different subdomains of the applicable organizational domain. A passing signature for an unrelated provider domain does not supply that alignment.

Review the sending service's custom DKIM and return-path configuration, then inspect a new message. The DMARC Generator starts with p=none. Current DMARC uses RFC 9989; pct no longer supplies a percentage rollout in that standard, and receiver support for newer testing behavior can vary.

Step 5: When authentication already passes

If SPF, DKIM and DMARC all pass and messages still go to spam, look at these next:

• Reverse DNS on your mail server. If you send from your own server, its IP address should have a reverse DNS name that resolves back to the same IP. Check it with the Reverse DNS Lookup. Your hosting company sets it, usually from the server's control panel.
• Blocklists. A shared IP address can be listed because of another customer. Your sending service can tell you, or move you to a different address.
• Consent and complaints. Confirm recipients asked for the mail, remove invalid addresses and honor unsubscribe requests. Review the complaint and reputation data your provider makes available.
• Message content. Inspect the links, sender identity and actual message shown to the recipient. Compare the provider's diagnostic information instead of treating a single word or formatting choice as a proven cause.

Confirm the fix

1. Check authoritative DNS, then repeat the recursive lookup after the previous record's TTL has expired.
2. Send a new test message and analyse its headers again. All three results should say pass.
3. Compare the receiving provider's new diagnostics. There is no guaranteed recovery time or inbox-placement outcome.

Questions

Sources

Reviewed by NosHost on 26 October 2026. See Gmail's sender guidelines, SPF lookup limits, DKIM and current DMARC.