Business emails in spam? SPF, DKIM and DMARC step by step

Company email messages landing in the inbox instead of spam, SPF, DKIM and DMARC authentication scheme

What changed in 2024

Google published guidelines for email senders that take effect from February 2024. Anyone sending to Gmail inboxes must have SPF or DKIM for the domain, a correct PTR record for the server’s IP address, and keep the spam complaint rate below 0.3%. Senders of more than 5,000 messages per day must also have both SPF and DKIM, DMARC, and a one‑click unsubscribe link. Yahoo introduced similar rules. Unauthenticated mail isn’t rejected outright, but it ends up in spam or may not be delivered at all.

For a small business that sends a few dozen emails daily from its own domain, this means one thing: without SPF, DKIM and DMARC the message has little chance of reaching the inbox of a Gmail user. Gmail is the most popular personal and a common business email service (Google Workspace).

Three records that determine deliverability

SPF

TXT record in the domain’s DNS that says: “only these servers may send mail for this domain”. Example for a business using Google Workspace and a newsletter system: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. Common mistakes: two SPF records in one domain (none work), missing the store or CRM server in the list, more than 10 DNS lookups (standard limit), a +all ending that allows anyone to send.

DKIM

Digital signature added to each message. The recipient's server checks it with the public key published in DNS. DKIM confirms that the content hasn't been altered in transit and that it was signed by an authorised server. Every system that sends on behalf of the domain (email, store, CRM, newsletter) needs its own DKIM selector. Most common problem: DKIM enabled for email but not for the store that sends order confirmations.

DMARC

Policy that tells the recipient what to do with a message that fails SPF or DKIM: do nothing (p=none), mark as spam (p=quarantine) or reject (p=reject). DMARC also provides reports: recipient servers send to the specified address summaries of who sent from your domain and whether authentication passed. Start always with p=none and reports, because a reject policy without prior analysis can block your own invoices sent from accounting software that no one remembered.

Domain and IP reputation

Records are a necessary condition, not sufficient. Recipient servers evaluate the sender's history: how many people marked messages as spam, how many addresses didn't exist, whether sending suddenly jumped from zero to thousands. A new domain or a new mailbox with no history has a neutral reputation and any larger send from it looks suspicious. Hence the warm‑up practice: for 2–4 weeks send an increasing number of messages to addresses that reply and don’t report spam.

Google provides Postmaster Tools, where for a domain you can see the spam complaint rate, domain and IP reputation, and authentication errors. It's free and worth checking before changing anything.

Content and recipient list

List bought or scraped from websites gives a high rate of non‑existent addresses and spam complaints. One such send can ruin a domain’s reputation for weeks.
Image only without text or a message with a single link and a URL shortener looks like phishing.
No unsubscribe option in a marketing email violates Gmail guidelines and local law (consent for commercial information).
Sending from an address that can’t be replied to (noreply) lowers engagement, and replies are a positive signal for filters.
Links to low‑reputation domains in the content, even in the footer, lower the rating of the whole message.

Checklist: what to review in 30 minutes

Check the domain’s SPF record (any DNS lookup tool). Is there one? Does it include all systems that send on your behalf?
Send a test email to your own Gmail address, open “Show original”. With SPF, DKIM and DMARC it should be PASS.
Check whether your online store and invoicing system also sign with DKIM. Order confirmation sent to yourself, again “Show original”.
Add a DMARC record with p=none and a report address. After a week review the reports: are all sources passing.
Create an account in Google Postmaster Tools and check the spam complaint rate.
If everything is PASS but emails still land in spam, the issue is reputation or content. That requires analysis of reports and sending history.

Online store: transactional emails also end up in spam

A separate issue, often overlooked: order confirmations, shipping notifications and password resets sent by the store. A WooCommerce store by default sends mail using the server's PHP mail function, without DKIM, from the shared hosting IP that carries the reputation of all sites on that server. Result: the customer doesn't receive the confirmation, writes "I didn't get the email", support replies "please check spam". Every such exchange costs you and reduces trust.

The solution is standard: the store sends through an SMTP server with authentication (company mailbox or a transactional service like SMTP API), the store domain has SPF for that server and DKIM for it, and the sender address is a real mailbox that can receive replies. After the change you test it just like regular mail: a test order to a Gmail address and "Show original". The same issue applies to invoicing programs and reservation systems that send from your domain, each of them appears as a separate source in DMARC reports.

How much does improving deliverability cost

On the market, just setting up the infrastructure for cold emailing (2‑4 mailboxes, SPF, DKIM, DMARC, warm‑up) is priced at a modest range, and running a campaign costs a variable monthly fee. SaaS tools for cold emailing are available at a modest monthly price range (mailuj.io). An email message audit is offered at a reasonable fee.

Our prices from the price list on the email deliverability page, final:

Deliverability audit, at a competitive price: SPF, DKIM, DMARC, MX, PTR, domain reputation, test to major mail providers, report with a list of fixes.
Sending infrastructure, at a standard rate: up to 2 sending domains and 4 mailboxes, records, warm‑up, configuration of the sending tool. Additional domain with 2 mailboxes +for an additional modest fee.
Deliverability care, a modest monthly fee: reading DMARC reports, reacting to reputation drops, maintaining warm‑up.

You purchase domains, tool licences and address list verification yourself, according to our list. We do not sell address lists nor send to lists whose source you don't know, because that harms domain reputation and violates the law.

Frequently asked questions

How to check if my emails have correct SPF, DKIM and DMARC?

Send a message to your own Gmail address, open it and choose "Show original". At the top Gmail shows the SPF, DKIM and DMARC result: PASS means the configuration is correct. Repeat the test from every system that sends on your behalf: email, store, invoicing program.

Does a small business also need DMARC?

Gmail’s guidelines require DMARC for senders of more than 5,000 messages per day, but they also recommend it for smaller senders. In practice, DMARC with a none policy doesn’t block anything, it just provides reports that show if anyone is spoofing your domain.

Emails to customers on Gmail go to spam, but not on other services. Why?

Gmail uses its own thresholds: it requires authentication, a correct PTR and a low spam complaint rate. Other servers can be more lenient. Start by checking SPF and DKIM, then use Google Postmaster Tools to see your domain’s reputation in Gmail’s eyes.

Will changing email hosting solve the problem?

Rarely. If records are missing or the recipient list is poor, the issue moves with the domain. A new server makes sense only if the current IP is on blacklists and the provider can’t fix it.

How much does an email deliverability audit cost?

With us a one‑time fee: check SPF, DKIM, DMARC, MX, PTR, domain reputation and test sends to major providers, with a report and list of fixes. We check domain records for free before you order.

Sources of prices and data

Market prices are indicative data from the listed sources, checked 8.10.2026. Our prices come from the current cansitelab.pro price list and are final.

Deliverability audit for a competitive price →

Why your business emails end up in spam and how to fix it: SPF, DKIM and DMARC