Why your email goes to spam: SPF, DKIM and DMARC explained

Your email goes to spam when the receiving server cannot prove the message really came from your domain, or does not trust the place it came from. SPF, DKIM and DMARC are three DNS records that supply that proof. Gmail, Yahoo and Outlook.com now expect them from every serious sender. This article explains what each record does, what the large mailbox providers ask for, and what else decides whether your mail reaches the inbox.

Why receiving servers distrust mail

Anyone can type any address into the From line of an email. Email was built without a check on the sender, and criminals use that to send invoices, payment changes and password resets that appear to come from real businesses. A receiving server has no way to tell your genuine invoice from a forged one unless your domain publishes rules it can check.

So every incoming message is judged on two questions. Can the sender prove it is allowed to use this domain? And does the sender have a history of sending mail people want? SPF, DKIM and DMARC answer the first question. Reputation answers the second. A message that fails either one is a candidate for the spam folder.

SPF: the list of servers allowed to send for you

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send mail for your domain. The receiving server looks at where the message came from and checks it against that list.

Three details catch businesses out:

• SPF checks a hidden address. It checks the envelope sender, the return address servers use for bounces. The From address your customer sees is not checked by SPF at all.
• One record only. A domain may publish a single SPF record. Two records, often left behind when a business adds a newsletter service, make SPF fail for every message.
• Ten lookups at most. Each "include" for a mail service costs DNS lookups. More than ten and the record is treated as broken.

SPF also breaks when mail is forwarded. The forwarding server is not on your list, so the check fails at the final destination unless the forwarder rewrites the return address.

DKIM: a signature that survives the journey

DKIM (DomainKeys Identified Mail) adds a digital signature to each message as it leaves your mail server. The public half of the signing key sits in your DNS. The receiving server uses it to confirm two things: the signed parts of the message were not changed on the way, and your domain takes responsibility for it.

That is all a DKIM pass proves. It does not say the message is honest or wanted. But a valid signature travels with the message through forwarding, which makes DKIM the more dependable of the two checks. The standard requires keys of at least 1,024 bits and recommends 2,048.

DMARC: tying both checks to the address people see

DMARC (Domain-based Message Authentication, Reporting and Conformance) closes the gap SPF leaves open. It passes only when SPF or DKIM passes for a domain that matches the From address your customer sees. That match is called alignment.

DMARC also lets you tell receivers what to do with mail that fails:

The reports are the useful part at the start. They show every server sending mail in your name, including the ones you forgot about. DMARC became a full internet standard in May 2026 as RFC 9989. It advises domain owners to start at none, move to quarantine, and only then reject, and to rely on DKIM rather than SPF alone.

What Gmail, Yahoo and Outlook.com now expect

Since February 2024, Gmail and Yahoo have required every sender to pass SPF or DKIM, to send over an encrypted connection, and to have matching forward and reverse DNS for the sending server. Microsoft added similar rules for Outlook.com in May 2025.

Larger senders face more. A domain that sends about 5,000 or more messages a day to personal accounts at these providers needs all three records:

• SPF and DKIM both passing.
• A DMARC record, where a policy of none is enough.
• A From address aligned with the SPF or DKIM domain.
• One-click unsubscribe on marketing mail. Yahoo asks for requests to be honoured within two days.
• Complaints kept low. Gmail asks senders to stay below 0.1% of messages reported as spam, and never to reach 0.3%.

Google says it began rejecting more non-compliant mail from November 2025, and it treats a domain that crosses the bulk threshold once as a bulk sender from then on. Microsoft sends non-compliant mail to Junk and says it may reject it.

The rest of reputation

Passing all three checks proves who sent a message. It does not prove anyone wants it. Providers also look at:

• Complaints. Every "report spam" click counts against you.
• Bounces. Sending repeatedly to addresses that do not exist tells providers your list is old or bought. Remove addresses that hard-bounce.
• Reverse DNS. The sending server's address should resolve to a sensible name that matches the name it announces.
• Blocklists. Services such as Spamhaus list servers that have sent spam or been compromised. Check your sending address there if mail is refused outright.
• Age. A brand-new domain has no history. Build volume slowly.

A compromised mailbox does the most damage here. One stolen password can send thousands of spam messages in an afternoon, and the reputation of every mailbox on that domain suffers. Our article on how infostealer malware steals saved passwords explains how that usually starts.

Checks you can do today

1. Read the headers of a message you sent. Send one to a personal Gmail address, open it, and choose "Show original". Gmail lists SPF, DKIM and DMARC as pass or fail. Our help article on reading full email headers explains the rest of what you see.
2. Look up your records. Check that your domain has exactly one SPF record, a DKIM record for each service that sends as you, and a DMARC record with a reporting address that actually exists.
3. List every service that sends as you. Your mailbox, your website's contact form, your accounting system, your newsletter tool. Each one needs to be in SPF or to sign with DKIM for your domain.
4. Check the blocklists if mail is being refused rather than filtered.

The step-by-step version, including a staged route to a DMARC reject policy, is in our help article on protecting your domain from spoofing and improving deliverability.

Common mistakes that send good mail to spam

• Two SPF records after adding a second mail service.
• A website contact form that sends From your main address through a server not listed in SPF and without a DKIM signature.
• A DMARC reporting address that does not exist, so no reports ever arrive and nobody notices failures.
• An SPF record that still lists a server you stopped using years ago.
• A contact form without spam protection, abused by bots to send confirmation mail to strangers. The complaints land on your domain.

How Noiz looks after it

Every Noiz shared hosting plan includes email with webmail and spam filtering. The Email Security add-on goes further for a domain hosted with Noiz: we keep SPF, DKIM and DMARC configured, sign the zone with DNSSEC, and add advanced spam and virus filtering. For an organisation that wants its mail on a server of its own, Private Email is quoted per deployment, and we run the server and set up the DKIM, SPF and DMARC records for it.

If your mail keeps landing in spam, add Email Security to your domain from the client area, or open a ticket and we will look at your records with you.

Sources

Checked 19 October 2026.

Standards

• RFC 7208, Sender Policy Framework (SPF)
• RFC 6376, DomainKeys Identified Mail (DKIM) Signatures
• RFC 8301, DKIM key sizes
• RFC 9989, DMARC
• RFC 7489, DMARC (2015, now obsoleted)
• RFC 8058, one-click unsubscribe

Mailbox providers

• Google, Email sender guidelines
• Google Workspace, Email sender guidelines FAQ
• Yahoo Sender Hub, Sender best practices
• Microsoft, Outlook.com policies, practices and guidelines

Reputation

• M3AAWG, Sender Best Common Practices, version 4.0 (August 2026)
• Spamhaus, ZEN blocklist

Noiz

• Email Security add-on
• Email hosting and Private Email
• How to protect your domain from spoofing and improve email deliverability
• How to find and read full email headers
• Best practices for mailing lists to avoid spam flagging

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.