SPF, DKIM and DMARC: how to keep your emails out of spam
If your emails land in spam, your domain is probably not proving that you sent them. We explain SPF, DKIM and DMARC without jargon, how to set them up in your DNS and which mistakes to avoid.
HostSpace team
4 min read
Key takeaways
- SPF says who is allowed to send email for your domain.
- DKIM signs your messages so receivers can verify them.
- DMARC says what to do with failing emails and sends you reports.
- All three are published as TXT records in your DNS.
Article contents
Why your emails end up in spam
When you send an email, the receiving server (Gmail, Outlook or any other) has to decide whether to trust it. Anyone can write an email that claims to come from your domain, so providers look for signals that you really sent it.
If your domain doesn't provide those signals, your messages may land in spam or even be rejected. The three main signals are called SPF, DKIM and DMARC. They sound technical, but the idea behind each one is simple.
Besides helping your emails get delivered, these records protect your brand. Without them, it is easier for someone to send fake messages that look like they come from your business to ask your customers for payments or personal details.
SPF, DKIM and DMARC in plain words
| Record | What it tells the receiver | Think of it as |
|---|---|---|
| SPF | Which servers are allowed to send email for your domain. | A guest list. |
| DKIM | That the message really came from your domain and was not altered on the way. | A seal or signature. |
| DMARC | What to do with emails that fail SPF or DKIM, and who to notify. | Instructions for the doorman. |
- SPF is a public list of the servers authorized to send email on behalf of your domain. If a message arrives from a server that isn't on the list, it looks suspicious.
- DKIM adds a digital signature to every email. The receiver checks it against a public key you publish on your domain, confirming the message is authentic.
- DMARC ties the other two together: it tells the receiver what to do if an email fails the checks (let it through, send it to spam or reject it) and where to send you reports.
How to set them up in your DNS
All three are published as TXT records in your domain's DNS zone, the same place that says where your website and email point. If that is new to you, start with what DNS is.
Here is roughly what they look like for a domain like tunegocio.mx:
- SPF, on the main domain:
v=spf1 include:_spf.tunegocio.mx ~all. The “include” part depends on your email provider. - DKIM, on a subdomain such as
default._domainkey.tunegocio.mx, with a long key generated by your email provider. You just copy it. - DMARC, on
_dmarc.tunegocio.mx:v=DMARC1; p=none;followed by the address where you want to receive reports.
If your email and domain are on the same cPanel hosting, SPF and DKIM can often be turned on from the email deliverability section, without typing anything by hand. DNS changes can take a few hours to show up across the internet.
If your email is with a different provider than your hosting, that provider will give you the exact SPF and DKIM values to add. Don't make them up or copy them from another domain: each service uses its own, and a wrong value can make your emails fail the check.
Common mistakes
- Having two SPF records. A domain can only have one. If you send email through several services, they are combined into a single record.
- Forgetting other services that send on your behalf. Your newsletter tool, online store or invoicing system must be authorized too.
- Pasting an incomplete DKIM key. It is a long string; if it gets cut off or picks up extra spaces, the signature won't validate.
- Setting DMARC to “reject” right away. You could block your own emails without noticing.
To check that everything is working, send a test email to a Gmail or Outlook account and open the option to view the original message or its technical details. There you will see whether SPF, DKIM and DMARC show as “PASS”. If one of them fails, fix that record before moving on.
Check your domain's reputation
These records help prove who you are, but reputation also depends on how you send. A few habits that protect it:
- Send bulk email only to people who agreed to receive it.
- Always include a clear way to unsubscribe from your newsletters.
- Remove addresses that bounce from your list.
- Check whether your domain or your server's IP appears on blocklists using public lookup tools.
Content matters too. Subject lines in all caps, messages that are just one image or shortened links that hide the real destination tend to raise flags with spam filters. Write the way you would write to a customer: clear, direct and with your full signature.
If you still use a free email account for your business, consider moving to business email with your domain, where you can actually configure all of this.
Frequently asked questions
It is a good idea. More and more email providers check them, and together they are the clearest way to show your emails are legitimate.
In your domain’s DNS zone, as TXT records. If your domain and email are on cPanel, they can often be turned on from the email deliverability section.
The records are only one part. Content, who you send to and your domain’s reputation also matter. Also check that every service sending on your behalf is included.
HostSpace team
We provide hosting, domains, VPS servers and business email with Spanish-speaking support. We write about what our customers ask us most.