Skip to content

Why are my business emails going to spam, and what are SPF, DKIM and DMARC?

The short answer

Mail providers check whether an email really comes from your domain. SPF lists the servers allowed to send for it, DKIM signs each message, and DMARC tells receivers what to do when those checks fail. Gmail and Yahoo ask every sender for SPF or DKIM; bulk senders need all three, plus one-click unsubscribe on marketing mail. Start by listing everything that sends email as your domain, including your website's forms and shop.

For
Owners whose domain email, order emails or newsletters land in spam
You leave with
What SPF, DKIM and DMARC each prove, what the big mail providers require, and what to ask whoever runs your domain
Time
5 min read

By Rahul Bansal,

On this page
  1. What each one proves
  2. What Gmail, Yahoo and Outlook.com ask
  3. What your website and shop emails need
  4. What to ask whoever runs your domain and email
  5. How we can help
  6. Questions people ask
  7. Sources

Anyone can type your address into the "From" line of an email. So mail providers look for proof that a message really comes from your domain, and Gmail says mail without it might be marked as spam or rejected. SPF, DKIM and DMARC are that proof: short text records in your domain's settings (DNS).

What each one proves

  • SPF: who may send. A line of text that lists the servers that send email for your domain. Receivers check it to see whether a message came from an authorised server. (Google: Set up SPF)
  • DKIM: the message is really yours. Your mail server signs each message with a private key, and receivers check the signature with a public key published on your domain. Yahoo adds that it shows the content was not changed on the way.
  • DMARC: what to do when the checks fail. It tells receivers to deliver, quarantine (send to spam) or reject mail that fails SPF or DKIM, and can send you reports. To pass, the domain that SPF or DKIM checked must match the one in the From line.

What Gmail, Yahoo and Outlook.com ask

These rules cover mail to personal accounts: @gmail.com, Yahoo addresses, and Outlook.com, Hotmail and Live addresses. Gmail says its guidelines do not apply to mail sent to Google Workspace accounts.

GmailYahooOutlook.com
Every senderSPF or DKIM; spam rate below 0.3%SPF or DKIM; spam rate below 0.3%No stated rule; Microsoft says all senders benefit
Who counts as bulkClose to 5,000 or more messages to personal Gmail accounts in 24 hours, counted across your primary domain"We will not specify a volume threshold"Domains sending over 5,000 emails a day
Bulk sendersSPF and DKIM, DMARC (policy can be none), From aligned with SPF or DKIMSameSPF and DKIM must pass, DMARC at least p=none, aligned with SPF or DKIM
Marketing mail (bulk)One-click unsubscribe, plus a visible link in the bodyOne-click unsubscribe (Yahoo also accepts a mailto link), plus a visible link; honour unsubscribes within 2 daysA functional, clearly visible unsubscribe link (recommended)
  • Bulk status is permanent at Gmail. Reach the 5,000 mark once and you stay a bulk sender.
  • Aim lower than 0.3%. Gmail's FAQ says to keep the user-reported spam rate below 0.1% and never let it reach 0.3%.
  • 48 hours for unsubscribes. Gmail recommends removing people within 48 hours of a one-click unsubscribe. A mailto link alone does not meet its requirement.
  • Enforcement is real. Gmail says that from November 2025 it is ramping up enforcement, and mail that fails its requirements will see disruptions, including temporary and permanent rejections. Microsoft first said failing bulk mail to Outlook.com would go to Junk; its 29 April 2025 update says it decided to reject such mail instead, with error "550; 5.7.515".

What your website and shop emails need

Google's SPF guide lists web servers, services that send automatic email such as contact forms, and any third-party service that sends for your domain. Google says your SPF record should include all of them, and we would also have each one sign with DKIM. If you add a new sender and forget the record, Google warns its messages could be marked as spam.

Our advice for forms and shop emails:

  • Send from your own domain. A form should not send as the visitor's address. Gmail warns that impersonating Gmail From addresses might affect your delivery. Put the visitor's address in Reply-To instead.
  • Keep receipts and promotions apart. Gmail says not to put promotions in sales receipts, and to give each kind of mail the same From address every time (for example sales@ for receipts, deals@ for promotions). Yahoo suggests separating marketing from transactional mail by IP or DKIM domain.
  • Mail only people who asked. Both providers say not to buy email lists, or sign people up with an opt-in box that is already ticked. A mailing list is also personal data: see what the DPDP Act asks of a small business.

What to ask whoever runs your domain and email

  1. Which services send email as our domain today: mailboxes, website, shop, newsletter, billing?
  2. Is each one in our SPF record, and does each one sign with DKIM?
  3. Do we have a DMARC record, and where do its reports go? Google suggests a group or dedicated mailbox, not your own inbox.
  4. Is our DMARC policy still none? Google recommends starting there, then moving to quarantine or reject as you learn how your mail is authenticated.
  5. Do our marketing emails carry one-click unsubscribe headers, and how fast are unsubscribes removed?
  6. Who updates these records when we add a new tool?

To check one message yourself, send it to someone else's Gmail address (Google says you can't verify DKIM with a test sent to yourself), open it there, choose More, then Show original, and look at Authentication-Results. Google says the DKIM result should read something like DKIM=pass. Google says a new SPF record can take up to 48 hours to start working.

How we can help

  • Writing and email campaigns to people who asked to hear from you, with a monthly performance report. Digital marketing.
  • Hosting, monitoring and backups, updates, and fixes when something breaks, from a named engineer who knows your system. Maintenance retainers.
  • Server, app and login hardening, then monitoring for downtime and attacks. Cybersecurity.

Questions people ask

Does this matter if we only send a few emails a day?

Yes. Gmail and Yahoo ask every sender for SPF or DKIM and a spam rate below 0.3%. Gmail also recommends SPF, DKIM and DMARC for every domain.

Do order confirmations need an unsubscribe link?

Not the one-click kind. Gmail and Yahoo require one-click unsubscribe only for marketing and promotional mail. Both say transactional mail is outside it: Yahoo names order confirmations and password resets, and Gmail names password resets, reservation confirmations and form submission confirmations.

Our contact form emails go to spam. Is that the same problem?

It can be. Google's SPF guide lists services that send automatic email, such as contact forms, among the senders your SPF record should include, and warns that mail from a sender left out of it could be marked as spam.

Can you look after a site or app you did not build?

Yes. Your engineer reviews it first, then we confirm what we can look after.

Sources

  1. Gmail Help: Email sender guidelinesChecked 27 October 2026
  2. Gmail Help: Email sender guidelines FAQChecked 27 October 2026
  3. Google Workspace Help: Set up SPFChecked 27 October 2026
  4. Google Workspace Help: Set up DKIMChecked 27 October 2026
  5. Google Workspace Help: Set up DMARCChecked 27 October 2026
  6. Yahoo Sender Hub: Sender Requirements & RecommendationsChecked 27 October 2026
  7. Yahoo Sender Hub: FAQsChecked 27 October 2026
  8. Microsoft Tech Community: Outlook's new requirements for high-volume sendersChecked 27 October 2026

Other companies change their prices and fees. Check the source before you rely on a figure.

Not sure what sends email as your domain?

Tell us what you run and where your domain and email are hosted. We reply within one working day.

Discuss your project