Emails Going to Spam: Why It Happens and What Helps

If your business emails keep landing in recipients' spam folders, in most cases the content of your message is not the problem – three missing technical records are: SPF, DKIM and DMARC. These three records prove to the world's mail providers that your emails really come from you. If they are missing, many inboxes treat your mail as potential forgeries – and filter it out as a precaution.

The good news: all three records are set once in your domain's DNS settings and cost nothing extra. The bad news: since the major mail providers significantly tightened their requirements in 2024, these records are effectively mandatory – even for small senders who only send a few quotes and invoices per week.

In this article we explain the three mechanisms so that you can understand them without an IT background, show where to set the records, and briefly cover the other spam traps that have nothing to do with technology.

Why mail providers check your emails with suspicion

Email is an old system in which the sender was originally trivial to fake – anyone could write whatever they wanted into the sender field. Fraudsters exploit exactly that to this day for fake invoices and phishing. The industry's answer: receiving inboxes check every incoming mail to see whether the sender is genuine. If your domain cannot answer those checks, your delivery rate drops – regardless of how reputable your business is.

The check rests on three mechanisms that work together. An image helps: picture your domain as a company building.

SPF – the list of authorised senders

SPF (Sender Policy Framework) is the visitor list at the front desk: a public record stating which mail servers are allowed to send on behalf of your domain. When an inbox receives a mail from yourcompany.com, it consults this list: if the mail comes from a listed server, that is a good sign. If it comes from an unknown server, it is suspicious.

In practice this means: your SPF record must include every service that sends email for you – your mail provider, and possibly your booking system or invoicing software. Forget one service, and precisely its mails land in spam.

DKIM – the seal on every mail

DKIM (DomainKeys Identified Mail) is the seal on the envelope: your mail server signs every outgoing message with a digital signature. The receiving inbox uses a public key in your DNS settings to check whether the seal is genuine and the mail was not altered in transit.

You do not build DKIM by hand – your mail provider supplies the key, and you store it as a DNS record. That is usually a one-time copy and paste.

DMARC – the house rule for forgeries

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the house rule that ties everything together: it tells recipients what to do with mails that fail the SPF and DKIM checks – nothing, quarantine them, or reject them. In addition, you can have reports sent to you showing who is sending mail in your name.

Without a DMARC record, recipients are missing this instruction entirely – and that is exactly what the major providers now count against you. To start, a lenient policy is enough; you can tighten it later once you are sure all your legitimate mail is cleanly signed.

Where to set the records: DNS at your domain provider

All three records live in your domain's DNS management – that is, wherever you registered your domain or manage your hosting. The process is similar everywhere:

1. Log in to your domain or hosting provider and open the DNS management for your domain.
2. Find the exact values for SPF and DKIM in your mail provider's help pages – every provider documents the correct entries.
3. Create the records as TXT records (SPF and DMARC directly on the domain, DKIM under a prescribed subdomain name).
4. Wait a few hours – DNS changes take time to propagate everywhere.

Important: there may be only one SPF record per domain. If one already exists, add the new service to the existing record instead of creating a second one – two SPF records make the check invalid.

How to check your current status

Before you change anything, it is worth looking at the status quo. There are two simple ways:

• Free check tools: online you will find freely usable testing services that check your domain for SPF, DKIM and DMARC records. Some let you send a test mail to a checking address and then show an evaluation with concrete pointers.
• Looking at the mail header: every mail program can display the technical header of a message. Send yourself a mail to an inbox at one of the large providers and search the header for the authentication results – there you will find a result such as "pass" or "fail" for each of SPF, DKIM and DMARC.

If it says "pass" three times, the technical foundation is fine. If not, you now know exactly where to start.

Other spam factors beyond the technology

SPF, DKIM and DMARC are the foundation – but not the whole story. Even with perfect technology, mail can land in spam if your sending behaviour sets off alarms:

• Bulk mail from your regular inbox: whoever writes to 300 recipients from the business mailbox behaves, from the providers' point of view, like a spammer. Mass mailings belong on newsletter services built for the purpose.
• Bought or scraped address lists: they produce lots of undeliverable addresses and spam complaints – both damage your domain's reputation lastingly.
• No unsubscribe link in newsletters: bulk mail without an easy way to opt out gets marked as spam by recipients – and every such mark worsens your deliverability for all future mail.
• Sensationalist subject lines and image-only mails: all caps, lots of exclamation marks and messages consisting of nothing but an image are classic spam patterns.

One building block often works quietly in the background here: the sender address itself. If you send from your own domain, all of these levers are in your own hands – with a freemail address, you share your sender reputation with millions of strangers. Why an email address with your own domain is the better choice beyond this as well is something we cover in a separate article.

Frequently Asked Questions

Why have my emails only recently started going to spam?

The most common reason: the major mail providers have tightened their requirements step by step since 2024. Setups that "somehow worked" for years have been failing the checks ever since. A provider switch, a new invoicing tool that sends mail, or a changed DNS configuration can also be the trigger – in those cases, check your SPF record first.

Do I really need all three of SPF, DKIM and DMARC?

Yes. The three mechanisms complement each other: SPF checks the sending server, DKIM checks that the message is unaltered, DMARC ties both to a clear instruction. Large recipients now expect the full interplay – setting only one of the three leaves the verification chain incomplete.

Can I set this up myself or do I need an IT service provider?

Many people manage it themselves: the mail provider supplies the values, and entering them in the DNS management is copy and paste. If several services send in your name (mail provider, shop, invoicing tool), it gets more confusing – then an hour of professional support is money well spent before a faulty record blocks legitimate mail.

My records are correct – yet some mails still land in spam. Why?

The technical check is only one part of the spam evaluation. Receiving inboxes additionally assess content, sending behaviour and your domain's history. Occasional misdeliveries happen – ask important contacts to add your address to their address book, which immediately improves delivery to that recipient.

How long until changes take effect?

The DNS records themselves are usually visible worldwide within a few hours. Your domain's reputation recovers more slowly, though: if your mail has been landing in spam for a while, it can take a few weeks of consistently clean sending before providers trust you again.