Emails Going to Spam? Fix SPF, DKIM and DMARC (Plain English)

Why your emails are going to spam

Receiving mail servers such as Gmail, Outlook and corporate filters decide in a fraction of a second whether to trust your message. The most common reasons a small business's email lands in spam or junk:

• No SPF, or a broken SPF record, for example two SPF records, or too many lookups.
• DKIM never switched on, so messages aren't signed with your domain.
• No DMARC record, so receivers have no policy for your domain and anyone can impersonate it.
• A third-party service sending as you (your accounting software, online store or newsletter tool) without being authorised.
• Your domain or sending server is on a blocklist, often after an account was hacked and used to send spam.
• Content and behaviour: link-heavy messages, attachments from new senders, or many recipients marking your mail as spam.

The large providers have also raised the bar. Google's email sender guidelines require all senders to Gmail to set up SPF or DKIM. Senders of more than 5,000 messages a day must have SPF, DKIM and DMARC, alignment, and one-click unsubscribe for marketing mail, and must keep spam complaints below 0.3%. Microsoft announced that from May 2025, Outlook.com would require SPF, DKIM and DMARC from domains sending more than 5,000 emails a day, and reject non-compliant mail with the error 550 5.7.515 (Microsoft's announcement). A small business rarely sends that much, but filters judge everyone by the same signals.

Check your domain in 10 seconds

Before changing anything, look at what you have now. Enter your domain in our free email and website security check. It reads your public DNS and tells you whether SPF, DKIM and DMARC exist and are valid, and whether HTTPS is set up properly. There's nothing to install, and it only reads public records.

Also send a test email from your business address to a personal Gmail account. In Gmail, open the message, choose Show original, and look for SPF: PASS, DKIM: PASS and DMARC: PASS. Anything other than PASS tells you where to start.

SPF explained, with examples for Microsoft 365 and Google

SPF (Sender Policy Framework) is a TXT record at the root of your domain (host @) listing which services may send email as your domain. Think of it as a guest list.

Sources: Microsoft's SPF guide and Google's SPF guide. Microsoft recommends -all (hard fail) when DKIM and DMARC are also in place. Google's example uses ~all (soft fail). Both work with DMARC.

Three rules that catch most people out:

• Only one SPF record per domain. If you add a second one for a new service, SPF fails for everything. Combine them instead, for example v=spf1 include:spf.protection.outlook.com include:servers.example.com -all.
• No more than 10 DNS lookups. Each include counts, and includes can contain more includes. Go over the limit and SPF returns a permanent error. Microsoft's guide explains how to count them.
• Don't use +all or ?all. They effectively allow anyone to send as you.

DKIM: turning it on

DKIM (DomainKeys Identified Mail) adds a digital signature to every email. The public key is published in your DNS. If the message is altered, or wasn't sent by an authorised service, the signature fails. Unlike SPF, DKIM usually survives forwarding.

Google Workspace

1. In the Admin console, go to Apps, Google Workspace, Gmail, then Authenticate email.
2. Generate a new record with a 2048-bit key (use 1024 only if your DNS host can't handle long records). The default selector is google.
3. Add the TXT record at google._domainkey in your DNS.
4. Return to the Admin console and click Start authentication. Google says it can take up to 48 hours to start working.

Source: Google's DKIM guide.

Microsoft 365

1. Open the Defender portal's Email authentication settings and select the DKIM tab.
2. Select your domain. If no keys exist, create them. The portal shows two CNAME values.
3. Add CNAME records at selector1._domainkey and selector2._domainkey pointing to those values.
4. After the records are live, switch on Sign messages for this domain with DKIM signatures.

Source: Microsoft's DKIM guide. A common mistake is adding the DNS records but never flipping that final switch.

DMARC: from p=none to enforcement, safely

DMARC ties SPF and DKIM to the address people actually see in the From line. It tells receivers what to do when a message fails, and sends you reports showing who is sending email as your domain. A message passes DMARC if SPF or DKIM passes and matches (aligns with) the From domain.

DMARC is a TXT record at host _dmarc. Both Microsoft and Google recommend a gradual rollout (Microsoft's DMARC guide, Google's DMARC guide):

1. Monitor: publish v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com. Nothing is blocked. You start receiving daily aggregate reports from large receivers.
2. Fix: read the reports for a couple of weeks. Every legitimate service, such as your mailboxes, website forms, accounting and store, should show SPF or DKIM passing and aligned. Fix any that don't.
3. Quarantine: change to p=quarantine, optionally with pct= below 100 to apply the policy to only part of the failing mail at first, then raise it.
4. Reject: once reports are clean, move to p=reject. Forged mail claiming to be from your domain is then refused.

DMARC reports arrive as compressed XML files. Use a dedicated mailbox or group to receive them, not someone's personal inbox. A DMARC reporting service turns them into readable charts.

Third-party senders: Xero, Shopify, Mailchimp and your website

Every service that sends email as your domain must be authorised, or it will fail DMARC once you enforce. Typical ones in a Singapore SME:

• Shopify (order confirmations): in Shopify admin go to Settings, Notifications, Sender email, and authenticate your domain by adding the CNAME records Shopify shows. Shopify notes that Gmail and Yahoo require domain authentication and a DMARC record to send from a branded address. Without it, Shopify rewrites your sender to a shopifyemail.com address. Source: Shopify Help Center.
• Mailchimp (newsletters): domain authentication adds two DKIM CNAME records and a DMARC record. Use the exact values shown in your Mailchimp account. Source: Mailchimp domain authentication.
• Xero (invoices and reminders): at the time of writing, Xero sends invoice emails from its own messaging service address at post.xero.com, with your address as the reply-to, so there's no record to add for your domain. Some customers' spam filters still catch them. If invoices go missing, ask clients to safelist Xero's sending address, or send important invoices from your own mailbox. See Xero's product ideas discussion and check your own Xero email settings.
• Your website's contact form: many websites send form notifications using the server's own mail, which isn't covered by your SPF. Route them through your Microsoft 365 or Google account, or a transactional email service you have authenticated.

Microsoft suggests sending bulk and marketing mail from a subdomain (for example news.yourcompany.com) so problems there don't damage the reputation of your main domain, and so each subdomain gets its own SPF lookup budget.

Blocklists (blacklists)

If authentication passes but mail still bounces or goes to junk, check whether your domain or sending IP is on a blocklist. Spamhaus offers a public lookup tool, and most blocklists explain their own removal process.

• Find the cause first. A blocklisting after a sudden burst of spam usually means a hacked mailbox. Reset the password, sign the attacker out, check for hidden forwarding rules, then request removal. Our hacked email guide covers the first hour.
• If you use Microsoft 365 or Google Workspace, you share their sending servers. An IP listing is usually theirs to fix, and a domain listing is yours.
• Request delisting only once the problem is fixed. Repeat listings take longer to clear.

Do it yourself or get help?

DIY checklist for a small team:

1. Run the free domain check and a Gmail Show original test.
2. Make sure you have exactly one SPF record covering every service that sends as you.
3. Turn on DKIM for your mailboxes and for each third-party sender.
4. Publish DMARC at p=none with a reporting address, and read the reports for two to four weeks.
5. Move to p=quarantine, then p=reject, once all legitimate mail passes.
6. Check blocklists if problems continue, and fix the root cause before requesting removal.

Get help if invoices are going missing now, you don't know which services send as your domain, or you'd rather not interpret DMARC reports. Our Emails Land in Spam — Fix (S$249) lists every sender, sets up SPF, DKIM and DMARC, monitors DMARC for 14 days, then moves you to enforcement safely, with a before and after report. To keep an eye on things afterwards, the Monitor plan (S$29/month) includes email blocklist monitoring.