Emails going to spam? A guide to SPF, DKIM and DMARC for SMEs
You send the newsletter, the Black Friday campaign or the welcome email and the results don't show up. Opens drop, email sales fall and some customers say they never received anything. In many cases, the problem isn't the copy or the offer. It's the technical setup of your domain.
Since February 2024, Gmail has required senders to prove they are who they say they are. Yahoo and Microsoft's Outlook have followed the same path. And since November 2025, Gmail has stepped up enforcement of these rules: messages that don't comply can be rejected, temporarily or permanently. In this guide we explain, without jargon, what you need to set up and how to check that everything is right.
Imagine an online store that sends a campaign to 15,000 contacts before Black Friday. If some of those emails are rejected or end up in spam, the store loses sales without understanding why. And the problem doesn't stop at newsletters: it can also hit abandoned cart emails, welcome emails and the other automations that sell every day, without anyone noticing.
Why your emails go to spam
Email providers receive huge volumes of messages and have to decide, in seconds, which ones deserve to reach the inbox. To do that, they look at three things:
Authentication: does the domain prove it authorised that send?
Reputation: how many people mark your emails as spam?
Easy exit: can the recipient unsubscribe without effort?
Authentication is the first step for providers to trust your sends. If it's misconfigured, emails can go to spam or even be rejected. But passing authentication checks doesn't guarantee inbox placement: the domain's reputation and the quality of your sends still count.
What Gmail, Outlook and Yahoo require today
Gmail's sender rules have two levels.
For all senders
Set up SPF or DKIM on the sending domain.
Have valid forward and reverse DNS records and use a TLS connection (email marketing providers take care of this).
Keep the spam rate reported in Postmaster Tools below 0.3%.
Don't impersonate a @gmail.com address in the "From" field.
For senders of close to 5,000 emails in 24 hours to personal Gmail accounts
Set up SPF and DKIM.
Publish a DMARC policy (it can be p=none).
Align the "From" domain with the SPF or DKIM domain.
Allow one-click unsubscribe in marketing emails. A footer link isn't enough: the technical mechanism goes in the message headers, and your sending platform has to include it. Requests should be processed within 2 days.
Watch out for a detail that catches many SMEs by surprise: according to the Gmail FAQ, the threshold counts messages sent to personal Gmail accounts in a 24-hour period, and reaching it once is enough to be treated as a bulk sender permanently. All sends from the same primary domain count towards the threshold. A store with 20,000 contacts that runs a Christmas campaign can fall into this category, even if it sends little for the rest of the year.
One-click unsubscribe applies to marketing and subscribed emails. Purely transactional emails, such as order confirmations or password resets, are outside this rule, but they still need authentication.
Outlook, Hotmail and Live (Microsoft)
Microsoft now applies similar rules to Outlook.com and its other consumer email services (Hotmail, Live.com, MSN). According to the Outlook support page, anyone sending 5,000 or more messages to these services with the same domain in the "From" field has to meet three requirements:
SPF and DKIM published and valid.
A DMARC record (it can be p=none, quarantine or reject).
Messages that pass DMARC, with SPF or DKIM aligned with the "From" domain.
The difference is that there's no middle ground here: messages that fail are rejected with the error "550 5.7.515 Access denied". They don't go to spam, they simply don't arrive. If you sell to businesses, remember too that many business mailboxes run on Microsoft 365, with their own filters managed by each organisation, and a well-authenticated domain always starts with an advantage.
Yahoo
Yahoo splits its rules into two levels, according to its sender best practices. All senders must have at least SPF or DKIM, valid DNS records and a spam rate below 0.3%. Bulk senders must also set up SPF and DKIM, publish a DMARC policy of at least p=none with the domain aligned, offer one-click unsubscribe and process unsubscribe requests within 2 days.
The conclusion is simple: even if you aren't a bulk sender today, set everything up. It's the safest way to avoid surprises in your next big campaign.
SPF, DKIM and DMARC explained in plain English
SPF: a record published in DNS that identifies the servers authorised to send email on behalf of a domain. For example, Google Workspace for everyday email and Mailchimp, Brevo or Klaviyo for newsletters. Note that SPF checks the domain of the technical return address (Return-Path), which may not be the same one the customer sees in the "From" field. Many email marketing platforms use their own domain for that address. That's why SPF alone isn't enough and should be set up together with DKIM and DMARC.
DKIM: a digital signature that the sending service adds to each message. The recipient confirms, through a key published in your DNS, that the email wasn't altered along the way and really came from you.
DMARC: a policy that checks whether the domain shown to the recipient matches the domain authenticated by SPF or DKIM. It's enough for one of these mechanisms to pass and be aligned. The opposite of what you'd expect can happen: SPF and DKIM both show PASS and DMARC still fails, because both authenticate the platform's domain and not yours. DMARC also tells providers what to do with messages that fail and where to send reports. You start with p=none (monitoring only) and, once the reports are clean, you can move up to quarantine or reject, which protects the brand against spoofing.
Alignment is the piece that ties everything together: the domain shown in the "From" field (for example, store.com) has to match the domain authenticated by SPF or DKIM. In the default (relaxed) mode, a subdomain of the same primary domain (for example, news.store.com) is also accepted. Sending as hello@store.com through a tool that signs with its own domain, and not yours, is one of the most common mistakes. That's why setting up the sending domain in your email marketing platform matters so much.
Step-by-step setup
Take inventory. List every tool that sends email with your domain: company email, newsletter platform, online store (order confirmations), CRM, invoicing.
Turn on authentication in each tool. In the domain settings of your email marketing platform there is almost always an option along the lines of "authenticate domain". The tool gives you the records (TXT or CNAME) to copy.
Check SPF. Each domain or subdomain can only have one SPF record; if it has two, providers treat it as invalid. Confirm which services really need to be in that record, because some use their own return address and don't need it. Don't add unnecessary services, and watch the technical limit of 10 DNS lookups per record. When in doubt, follow each provider's instructions.
Add the records to DNS. Log in to the panel of the service that manages your domain's DNS, which may not be where you bought the domain (for example, your store platform or a service such as Cloudflare), and paste the records. Propagation can take a few hours.
Publish DMARC. A starting point is to create a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, replacing the domain and address with yours. Make sure that mailbox exists and receives mail. Reports arrive as XML files that are hard to read, so it's worth using a DMARC report analysis tool. Remember that p=none only monitors: once you've confirmed all legitimate sending services, tighten the policy to quarantine and, later, reject.
Confirm one-click unsubscribe. The main email marketing platforms already include the required header, but confirm it's active and that every email has a visible unsubscribe link in the footer.
Test. Send real emails from each tool to a Gmail account, open the message menu and choose "Show original". Ideally you'll see PASS for SPF, DKIM and DMARC, and confirm that DMARC passes with your domain. Repeat the test for order confirmations, newsletters and automations, and also with an Outlook.com account.
After setup: protecting your reputation
Authentication opens the door, but it's recipient behaviour that decides whether you stay in. Gmail recommends keeping the spam rate below 0.1% and never reaching 0.3%. In practice:
Use Google Postmaster Tools. It's free: you add the domain, verify it with a TXT or CNAME record and can then see the spam rate of your sends to Gmail. The Compliance status dashboard shows whether you meet the sender rules. At low volumes the charts may stay empty, which is normal.
Only send to people who gave consent. Bought lists are the fastest route to the spam folder, and a problem under the GDPR too.
Clean the list regularly. Contacts who haven't engaged for months lower engagement and increase the risk of complaints. Don't decide on opens alone: privacy features, such as Apple Mail's, make that number unreliable. Look at clicks and purchases too.
Deliver what you promised at sign-up. If someone subscribed to monthly tips, sending daily promotions leads to complaints.
Make unsubscribing easy. A customer who can't find the link clicks "Report spam", and that weighs much more.
Important: SPF, DKIM and DMARC don't guarantee that emails reach the inbox. They are the technical foundation of good deliverability. Domain reputation, list quality and message relevance remain decisive.
Signs you need to act now
Open or click rates that suddenly dropped with no change in content.
Customers finding your emails in the spam folder, rejected messages or campaigns with sharp drops in deliverability. Landing in Gmail's Promotions tab isn't a problem in itself: it's an inbox category.
Messages bounced with Gmail rejection codes or with Outlook's 550 5.7.515 error.
Automations, such as the abandoned cart email, that stopped generating sales for no apparent reason.
You can't answer the question "which tools send email with our domain?".
If any of these points sound familiar, it's worth reviewing your setup before your next important campaign, especially before Black Friday and Christmas, when every email counts. Email remains an important channel for SMEs and online stores, but it only works if it reaches the inbox. At Rocket Fuel Ads we handle the technical side and the email marketing strategy, with automations and newsletters that sell, alongside SEO and ads, including white-label work for agencies.
Wrapping up
For bulk senders, SPF, DKIM and DMARC are already mandatory at Gmail, Outlook and Yahoo. For everyone else, they are the recommended setup and the basis for emails reaching the people who asked for them. In most cases, setting them up takes little time, costs nothing extra and avoids losing sales without knowing why. After that, look after your reputation: consent, clean lists and easy unsubscribing.
Want to know whether your emails are reaching your customers? Request your free review and we'll look at your domain setup and your campaigns.
Comments