Why e-mails land in spam, and what SPF, DKIM and DMARC have to do with it
SPF, DKIM and DMARC are DNS records that prove an e-mail really comes from your domain. Without them, Gmail, Outlook and others treat your mail as less trustworthy and others can send in your name. Every domain that sends mail needs all three; DMARC should end at quarantine or reject.
The three records at a glance
SPF
Who may send?
A TXT record on the domain listing the allowed servers. Exactly one, at most 10 DNS lookups.
DKIM
Is the mail unaltered?
Your mail server signs every mail; the public key is in DNS under selector._domainkey.
DMARC
What if not?
A TXT record under _dmarc: none, quarantine or reject, plus an address for reports.
Setting it up in five steps
- 1.List everything that sends mail in your name: mailbox, website forms, newsletter, shop, invoicing.
- 2.Merge their entries into one SPF record and keep it under 10 lookups.
- 3.Turn on DKIM in your mail provider and in every sending service, and publish the keys.
- 4.Add DMARC with p=none and a report address, then read the reports for two to four weeks.
- 5.When all legitimate senders pass, move to p=quarantine and later to p=reject.
E-mail check: frequently asked questions
What are SPF, DKIM and DMARC?
Three DNS records that prove your e-mails really come from you. SPF lists the servers allowed to send for your domain. DKIM signs each e-mail with a key. DMARC tells receivers what to do when SPF or DKIM fail (deliver, put in spam, reject) and sends you reports.
Why do my e-mails land in spam?
There are many reasons, but a missing or broken SPF, DKIM or DMARC setup is the most common technical one. Since 2024 Google and Yahoo require these records from bulk senders, and Microsoft since 2025. Smaller senders feel it too, because filters trust authenticated mail more.
What does the check do exactly?
It reads public DNS records of the domain: MX, the SPF record including all nested includes, DMARC on the domain and its parent, about 20 common DKIM selectors, MTA-STS and BIMI. No mail is sent and no mail server is contacted.
The check finds no DKIM key. Is something wrong?
Not necessarily. A DKIM key sits under a name (selector) that the provider chooses. We query the common ones; if yours uses another, the check cannot see it. Open a mail you sent and look for “DKIM-Signature” in the header: if it is there, DKIM works.
Should I set DMARC to reject straight away?
No. Start with p=none and a report address. The reports show which services send in your name: newsletter tool, shop, accounting software. Once all of them pass SPF or DKIM, move to quarantine and then reject. Going straight to reject can block real mail.