Quick answer
If emails from your domain are going to spam, the most common cause is missing or incorrect SPF, DKIM and DMARC records in DNS. Set up an SPF record with authorized mail servers, enable DKIM signing in your email service, and add a DMARC record in monitoring mode. After DNS propagation, check the results and gradually tighten the policy.
How to recognize the problem
- Emails sent from your business domain end up in the Junk or Spam folder
- Recipients do not see the message or open it only after several days
- Replies to your emails bounce back as undelivered or rejected
- Gmail and Outlook show a warning that the message was not verified
- Clients complain they are not receiving invoices and notifications you send them
Most common causes
No SPF record or an incomplete one
The domain has no TXT record listing the servers authorized to send mail on its behalf. Recipients therefore cannot confirm that the message comes from legitimate infrastructure.
DKIM signing is not enabled
The email service does not sign messages with a private key, or the public key is not published in DNS. Without a signature, the recipient cannot verify that the message was not altered in transit.
DMARC record missing or too strict
Without a DMARC record, you have no reports on who is sending mail on behalf of the domain. If the policy is set to `reject` right away, legitimate mail can be rejected.
Mail is sent through a server that is not listed
A website, application or printer sends emails through an SMTP server that is not in the SPF record. Such messages look forged and easily end up in spam.
Poor domain or IP reputation
A new domain, a large volume of messages at once, or recipient spam complaints lower your reputation. Even correct records will not help immediately then.
Step-by-step fix
- 1
Check current DNS records
Open a DNS lookup tool or the command line and check the domain's TXT records. On Windows you can use
nslookup -type=TXT yourdomain.com, and on macOS or Linuxdig TXT yourdomain.com. Write down what exists before changes, so you know what to revert to if something goes wrong. - 2
Create an SPF record
In your hosting or registrar DNS panel, add a TXT record at the domain root with a value starting with
v=spf1. Include all services that send mail on behalf of the domain, for exampleinclude:for your email provider, and end with~alluntil you are sure everything is covered. Never put two SPF records, because recipients will then treat the domain as invalid. - 3
Enable DKIM in your email service
In the email service administration, find the domain and authentication section and enable DKIM. The service will show you a selector and public key that you need to publish as a TXT record, usually at an address like
selector._domainkey.yourdomain.com. Wait for propagation, then send a test email and check whether the signature passed. - 4
Add a DMARC record in monitoring mode
Publish a TXT record at
_dmarc.yourdomain.comwith the valuev=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. This mode does not reject mail, but sends you reports on who is sending emails on behalf of the domain. Set the reporting address to a mailbox you read regularly. - 5
Send test emails
Send a message to Gmail, Outlook and an address on your own domain. In Gmail, open the message, click the three dots and select Show original to see the SPF, DKIM and DMARC check results. If something fails, go back to the record marked as the problem.
- 6
Analyze DMARC reports
After a few days, review the reports sent by recipients. Pay attention to IP addresses and services sending mail that are not in the SPF record. Add them to SPF or stop sending through them, then check again.
- 7
Tighten the policy gradually
When reports show that all legitimate mail passes, change the DMARC policy from
p=nonetop=quarantine, and later top=reject. Leave a few days between changes to see the effect. A sudden change torejectcan reject legitimate emails. - 8
Check domain reputation
Register the domain with Google Postmaster Tools if you send larger volumes of mail and monitor reputation. Also check that the domain and IP are not on blacklists. If they are, submit a removal request and reduce sending volume until reputation recovers.
If emails still go to spam after setup
Check the message content: too many images, large attachments, short links and words that resemble ads increase the chance of spam. Make sure the domain has a correct MX record and that mail is sent from a server with a PTR record matching the name. If you use an external sending service, check that the domain is verified there and whether the service requires additional records. For business email, consider sending through a provider with good reputation and warming up a new domain by gradually increasing the number of messages. Remember that DNS changes may only be visible after several hours, so do not draw conclusions immediately.
How to prevent it
- Regularly review DMARC reports and immediately add new services to the SPF record
- Never publish two SPF records and keep the total number of `include` entries under control
- Enable DKIM for every service that sends mail on behalf of the domain
- Monitor domain reputation and respond to recipient complaints
When to call a professional
If you cannot access the DNS panel, do not know which services send mail on behalf of the domain, or legitimate mail stops arriving after changes, it is better to contact IT support. An incorrect DMARC or SPF record can reject business email until it is corrected.
Website development · Fast, SEO-ready, multilingual websitesFAQ
How long does it take for DNS record changes to become visible?
Changes are usually visible within a few hours, but it can take up to 24 to 48 hours due to caching. Send a test email only when the check shows the new records.
Can I set DMARC to reject right away?
It is not recommended. First use `p=none` and monitor reports, then gradually move to `quarantine` and `reject` when you are sure all legitimate mail passes.
What if I use multiple services for sending mail?
Every service must be covered by the SPF record or sign mail with a DKIM key for your domain. Check each service's documentation and add the exact `include` values.