If customers keep telling you your emails ended up in spam, the problem usually isn't what you wrote. It's that the big inboxes can't confirm the email really came from you. Three DNS records handle that proof: SPF, DKIM and DMARC.
What each one does
- SPF is a list of the services allowed to send email for your domain. Think of it as the guest list at the door.
- DKIM puts a digital signature on each message, so the inbox can tell it wasn't changed on the way.
- DMARC tells inboxes what to do when a message fails those checks, and sends you reports about who is sending as you.
You need all three, and they need to agree with each other. A common mistake is setting up SPF for your email host and then forgetting your newsletter tool, your booking system or your invoicing app, which also send as your domain.
What the big inboxes require now
Google and Yahoo started enforcing sender rules in February 2024, and Microsoft followed for Outlook.com in May 2025 (summary here). The strictest rules apply to anyone sending 5,000 or more emails a day, but the basics apply to everyone. Yahoo's rules are a good summary:
- Every sender: pass SPF or DKIM, keep spam complaints under 0.3%, and have valid DNS for your sending servers.
- Bulk senders: pass both SPF and DKIM, publish a DMARC record (at least p=none) that passes and lines up with your From address, and include a one-click unsubscribe that's honored within two days.
Even if you send far less than 5,000 a day, set all three up. It's the difference between "probably delivered" and "delivered."
How to check yours
Send an email from your business address to a Gmail account. Open it, click the three dots and choose "Show original." Look for SPF, DKIM and DMARC. Each should say PASS. If any says FAIL or is missing, that's your fix list.
How to fix it
- List every service that sends email as your domain: your email host, newsletter tool, CRM, booking app, invoicing.
- Combine them into one SPF record. You only get one.
- Turn on DKIM in each of those services and add the records they give you.
- Publish a DMARC record starting at p=none, so you get reports without blocking anything.
- Read the reports for a few weeks, fix whatever fails, then tighten to p=quarantine.
It's an afternoon of careful work if you're comfortable in DNS settings. If you're not, our email deliverability audit scores your domain in 24 hours and gives you a plain-language fix list for $129.