SPF, DKIM and DMARC: why your emails land in spam and how to avoid it

You sent the proposal to an important customer. Two days go by without a reply. You call them and they say: “It never arrived”. They check the spam folder and there it is, next to the casino offers.

It is not bad luck. For Gmail and other providers, an email that does not prove where it comes from is suspicious. That proof has three technical names: SPF, DKIM and DMARC. This is what they are and why they are no longer optional.

What are SPF, DKIM and DMARC?

They are three records set up in your domain's DNS to prove that an email really came from your company.

Record	What it does	Analogy
SPF	Lists the servers authorized to send with your domain	The list of people authorized to sign for the company
DKIM	Signs each email with a digital key	The seal that proves the envelope was not opened
DMARC	Says what to do if the others fail and sends reports	The security protocol when something does not add up

What does Gmail require from email senders?

Since February 1, 2024, Gmail has requirements for all senders and stricter ones for those who send a lot. According to Google's official sender guidelines:

For all senders:

• Authentication with SPF or DKIM.
• Valid DNS records for the sending domains and IPs.
• A TLS connection to transmit email.
• Spam rate below 0.30% in Postmaster Tools.
• Do not impersonate anyone in the “From:” header.

In addition, for those sending more than 5,000 messages a day:

• DMARC set up on the domain.
• Alignment: the “From:” domain must match the SPF or DKIM domain.
• One-click unsubscribe in marketing and subscription emails.

Common mistake: sending campaigns from a free email address or from a tool without authenticating your domain. The first few hundred arrive; after that, everything starts landing in spam and your domain ends up with a bad reputation.

How do I set them up on my domain?

1. Take an inventory of everything that sends email with your domain: your email provider, your CRM, your email marketing tool, your store.
2. Publish a single SPF record that includes all those services.
3. Turn on DKIM in each service and publish its keys in the DNS.
4. Publish DMARC in monitoring mode (p=none) and review the reports for a few weeks.
5. Tighten the policy to quarantine or reject once all legitimate mail passes.

Watch out: DNS also controls your website and the receipt of your email. A bad change can leave your company without email. Back up the current records before touching anything and change only the authentication records.

Why does this also matter for your marketing?

Because without authentication, your campaigns do not arrive. If you do email marketing, the tool may be excellent, but if your domain is not authenticated, the email ends up in spam. We see it applied in email marketing with Zoho Campaigns. In addition, a domain with properly configured email makes processes like Meta business verification by domain easier.

If your DNS is on Cloudflare, managing these records is simpler; we tell you what its free plan includes in Cloudflare for small businesses.

In short

SPF says who can send, DKIM signs each email and DMARC defines what to do if something fails. Gmail has required them since 2024, and without them your proposals and campaigns end up next to the casino offers. Properly set up, your email reaches the inbox again. We review and configure them in our hosting and domains service.