Why Are My Emails Going to Spam? How to Fix SPF, DKIM & DMARC

You send an important proposal to a client or a password reset link to a new user, and days later you find out they never saw it. Your email landed directly in their Spam or Junk folder—or worse, was rejected entirely by Gmail with a 550-5.7.26 Unauthenticated email error.

With Google, Yahoo, and Microsoft enforcing strict domain authentication rules for all email senders, simply sending an email from your server is no longer enough. To guarantee 99%+ inbox placement, you must configure the holy trinity of email authentication: SPF, DKIM, and DMARC. In this step-by-step guide, we will show you how to set up all three DNS records in under 10 minutes.

"Email spam filters no longer trust senders by default. If your domain does not have SPF, DKIM, and DMARC published in DNS, your emails are treated like forged spam."

1. Why Emails Go to Spam (The 2026 Rules)

In the past, spam filters primarily scanned email text for "trigger words" like FREE or BUY NOW. Today, 90% of spam filtering happens at the DNS network level before the recipient's mail server even reads the subject line.

When your server connects to Gmail to deliver an email, Gmail asks your domain three cryptographic verification questions:

1. SPF Check: Is the sending server's IP address listed as an authorized sender in your domain's DNS?
2. DKIM Check: Does the email header contain a cryptographic digital signature matching the public key published in your DNS?
3. DMARC Check: What should we do with this email if SPF or DKIM fails (accept, quarantine to spam, or reject completely)?

2. Setting Up SPF (Sender Policy Framework)

An SPF Record is a single TXT record placed at your root apex domain (yourdomain.com). It contains a list of authorized IP addresses and third-party mail providers (like Google Workspace, SendGrid, or Mailgun):

Understanding the Modifiers:

• v=spf1: Declares the record as SPF Version 1.
• include:_spf.google.com: Authorizes Google Workspace / Gmail servers to send for your domain.
• ip4:198.51.100.25: Authorizes your web server's dedicated IP address.
• ~all (SoftFail): Recommends accepting mail but marking as suspicious if SPF fails.
• -all (HardFail): Strict rejection if the sender is not in the list.

3. Configuring DKIM (Cryptographic Signatures)

DKIM creates a pair of cryptographic keys: a private key that stays securely inside your mail server, and a public key published as a TXT record in your domain's DNS.

When you send an email, your server signs the message body and headers with the private key. When Gmail receives the email, it grabs the public key from your DNS and validates that the message was not modified in transit.

You can generate your DKIM record inside your cPanel (Email Deliverability section) or inside your Google Workspace / Microsoft 365 Admin Console.

4. Creating Your DMARC TXT Record

DMARC ties SPF and DKIM together. It instructs recipient mail servers what to do if an email pretending to come from your domain fails SPF or DKIM checks, and tells them where to send daily XML delivery reports.

5. Checking Reverse DNS (PTR Records)

If you are sending transactional emails directly from your VPS (DigitalOcean, Linode, AWS EC2), your server's public IP address must have a matching Reverse DNS (PTR) record that resolves back to your hostname (e.g. mail.yourdomain.com). If PTR is missing, major mail servers will reject your connection immediately.

Frequently Asked Questions

Conclusion

Implementing SPF, DKIM, and DMARC protects your brand from impersonation while guaranteeing that your critical client emails land directly in the primary inbox.