You send a newsletter to 500 customers and only a handful reply. Often the problem isn't your message. It's that many of those emails went straight to spam. Since 2024, Gmail, Yahoo and Microsoft have required senders to prove their emails are genuine. Three settings on your domain do that job: SPF, DKIM and DMARC.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a short line of text added to your domain's DNS. It lists the services that are allowed to send email using your domain, for example your email marketing platform. When a mailbox receives an email claiming to be from you, it checks whether it came from one of those approved services.
A common mistake is creating two SPF records when adding a new service. A domain must have only one SPF record, so new services are added to the existing line instead.
DKIM: a tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving mailbox checks that signature against a public key published on your domain. If the email was altered on the way, or didn't really come from you, the check fails.
DMARC: what to do when checks fail
DMARC tells mailboxes what to do with emails that fail SPF or DKIM, and where to send reports about them. Most businesses start with a monitoring policy (p=none), review the reports, then tighten the policy once they are sure all their genuine email passes.
Authentication is the foundation, not the whole house
Even perfectly authenticated emails can land in spam if they go to people who never asked for them. The habits that keep you in the inbox are simple:
- Only email people who opted in, ideally confirmed by a double opt-in email
- Include a clear unsubscribe link in every message, and honour it immediately
- Remove addresses that bounce
- Send consistently rather than in sudden large bursts
If your emails keep landing in spam, start by checking these three records. It is usually a one-hour fix with a lasting effect.