Email that lands in the inbox: SPF, DKIM and why yours goes to spam

A customer fills in your contact form, you reply with a quote, and it lands in their spam folder or never arrives at all. This happens more than most business owners realise, and it rarely has anything to do with what you wrote. It comes down to whether your domain is set up to prove the email actually came from you.

What SPF and DKIM actually do

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks that record. If the sending server isn't on the list, the message looks forged, even if it isn't.

DKIM (DomainKeys Identified Mail) works differently. It attaches a digital signature to outgoing mail, generated with a private key your mail provider holds, and publishes the matching public key in your DNS. The receiving server checks the signature against that key. If it matches, the message wasn't altered in transit and genuinely came from a server holding your key.

Why this ends up in spam

• Your invoicing tool, CRM or contact form sends email from your domain through a different server than the one SPF allows
• You switched email or hosting providers and never updated the SPF record for the new sender
• DKIM was never configured because it requires a DNS change most site builders don't prompt for
• No DMARC record exists to tell receiving servers what to do when SPF or DKIM fails, so they default to their own judgment, and that judgment increasingly means spam or rejection

DMARC ties the other two together

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer. It tells receiving servers what to do when a message fails SPF or DKIM: let it through, send it to spam, or reject it outright. Without a DMARC record, servers guess, and Gmail, Outlook and Yahoo have all become stricter guessers over the past two years.

That threshold is for bulk senders, but the filtering logic behind it applies to everyone. A domain without these records reads as suspicious to Gmail and Yahoo regardless of how many emails it sends, it's just that bulk senders get rejected outright while smaller senders get quietly filtered.

How to check your own setup

You don't need special software for this. MXToolbox and Google's own Admin Toolbox both offer free SPF, DKIM and DMARC lookups. Enter your domain and you get a pass or fail in seconds. If any of the three come back missing or failing, that's usually the actual reason your emails aren't landing, not your subject line or your sending frequency.

Fixing it

1. 1Log in to wherever your domain's DNS is managed, usually your registrar or hosting provider, not your email provider
2. 2Add or correct the SPF record so it includes every service that sends mail on your behalf: your email provider, invoicing tool, CRM and website contact form
3. 3Enable DKIM in your email provider's settings and publish the key it gives you as a DNS record
4. 4Add a DMARC record starting with a p=none policy so you can monitor without risking legitimate mail, then tighten it once you confirm everything passes
5. 5Re-run the lookup after DNS propagates, usually under an hour, occasionally up to 24

None of this touches your website's code or design. It's DNS plumbing, and it's exactly the kind of thing that quietly breaks when you switch providers or add a new tool, then sits broken for months because nobody notices until a client says they never got your quote. If keeping track of this isn't something you want to own yourself, it's one of the things covered under our ongoing maintenance and support, alongside uptime, backups and the other unglamorous parts of keeping a site, and its email, working.

Check your domain today if you haven't in the last year. Providers have tightened their requirements twice in the past two years, and a setup that passed in 2023 isn't guaranteed to still pass now.