SPF, DKIM and DMARC: why your emails end up in spam and how to fix them

In short: SPF says which servers can send mail for your domain, DKIM signs every message and DMARC decides what happens when the checks fail. Since 1 February 2024 Gmail has required SPF or DKIM from all senders, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to personal Gmail accounts, with one-click unsubscribe in promotional messages.

Two email problems look different but start in the same place. The first: your shop's emails (order confirmations, newsletters, customer service replies) end up in the junk folder. The second: someone sends fake messages that appear to come from your domain. In both cases the answer lies in three DNS records: SPF, DKIM and DMARC.

What the three records do

SPF: who can send

The SPF record lists the servers and services authorised to send mail for your domain: your email provider, your newsletter platform, the shop that sends confirmations. The receiving server checks whether the sender is on the list. The record must include every real sender: if you leave one out, its emails are rejected or downgraded.

DKIM: the signature

Every message goes out with a digital signature. The public key sits in your domain's DNS. The recipient verifies the signature and checks that the message has not been altered and really comes from that domain. Each service that sends in your name has its own key. Google specifies 1024 bits as a minimum and recommends 2048 bits.

DMARC: the rule

DMARC ties the two checks to the address the recipient sees (the 'From' field). It says what to do if the checks fail. It has three levels:

• none: no action. Used to observe through the reports.
• quarantine: suspicious messages go to spam.
• reject: suspicious messages are refused.

For a message to pass DMARC, the domain authenticated by SPF or DKIM must be aligned with the one in the 'From' field: identical or, with relaxed alignment, one of its subdomains.

What Gmail has required since 2024

Since 1 February 2024 Google has applied stricter rules. These apply to everyone sending to Gmail:

• SPF or DKIM for the sending domain;
• valid forward and reverse DNS records for domains and IP addresses;
• an encrypted TLS connection;
• a spam complaint rate below 0.3% in Postmaster Tools. Google recommends staying below 0.10%.

Anyone sending more than 5,000 messages a day to personal Gmail accounts (@gmail.com and @googlemail.com) must also have:

• SPF and DKIM together with DMARC (which can be set to none);
• the 'From' domain aligned with the SPF or DKIM domain;
• for marketing messages, one-click unsubscribe (List-Unsubscribe and List-Unsubscribe-Post headers) and a visible link in the body of the message.

Even a small business would do well to meet all of them to protect its domain's reputation.

How to set it up

1. List everyone who sends in the domain's name: company email, newsletters, shop, customer service, CRM, invoicing.
2. Set up SPF with all the real senders. The technical limit is ten DNS lookups: include too many services and you go over it.
3. Enable DKIM in each service and publish the key in DNS.
4. Publish DMARC with p=none and an address for receiving reports.
5. Read the reports for a few weeks and fix any sender that fails the checks.
6. Move to quarantine and then to reject once all legitimate senders are in order.

Common mistakes

• Two SPF records on the same domain: you need only one.
• A newsletter service that doesn't sign with your domain.
• DMARC set straight to reject without observing first: legitimate emails get blocked.
• Forgetting subdomains, or the domain the shop uses for confirmations.
• A poorly kept mailing list: too many non-existent or uninterested addresses push up spam complaints.

How to check

Send a message to a Gmail address and open 'Show original': 'PASS' should appear next to SPF, DKIM and DMARC. There are also no-cost tools that read your domain's records and flag any errors.

Further reading: email for an online shop · phishing at work · email marketing

Frequently asked questions

What is SPF?

A DNS record that lists the servers authorised to send email on behalf of your domain. Receiving servers check it to work out whether the message comes from a legitimate source.

What is DKIM?

A digital signature added to every message by your email service. The public key sits in DNS and makes it possible to verify that the message has not been altered and comes from the stated domain. Google specifies keys of at least 1024 bits and recommends 2048 bits.

What is DMARC?

A record that tells receiving servers how to treat messages that fail SPF or DKIM or are not aligned with the sender's visible domain: ignore them, quarantine them or reject them. It also lets you receive reports on what is being sent.

What has Gmail required since 2024?

Since 1 February 2024 all senders must use SPF or DKIM, have valid reverse DNS records and a TLS connection, and keep their spam rate below 0.3%. Anyone sending more than 5,000 messages a day to personal Gmail accounts (@gmail.com and @googlemail.com) must use SPF, DKIM and aligned DMARC and offer one-click unsubscribe in marketing messages.