Skip to content
sporesecsporesec
Client loginFree intro call

SPF, DKIM and DMARC: why your email lands in spam

What the three email records do, which ones Google asks senders to set up, and what to ask your email or domain provider to check.

Run the free website scan

Checked on 2026-10-29

The problem

Mail that cannot be tied to your domain may be sent to spam or refused. Three records in your domain settings let receivers check the mail.

SPF

SPF is a list, published in your DNS, of the servers allowed to send mail for your domain. The standard (RFC 7208, 2014) limits the check to 10 DNS lookups; over that, the result is an error and receivers may ignore the record.

DKIM

DKIM is a signature added to each message by your mail provider. The receiver looks up your public key in DNS and checks the signature (RFC 6376, 2011). Google requires a key of 1024 bits or longer for mail to Gmail accounts and recommends 2048.

DMARC

DMARC is a rule you publish that says what receivers should do with mail that fails the SPF and DKIM checks, and where to send reports. It starts at none (watch only) and can be raised to quarantine or reject. DMARC was first published as RFC 7489 (2015); RFC 9989 replaced it.

What Google asks

Since February 1, 2024, Google asks everyone who sends mail to Gmail accounts to set up SPF or DKIM. Senders of 5,000 or more messages a day to Gmail accounts must also set up SPF, DKIM and DMARC, keep the spam rate reported in Postmaster Tools below 0.3%, and offer one-click unsubscribe in marketing mail.

What we check

We read your domain's public records: whether SPF is present and valid, whether DKIM is found at common selectors, and whether DMARC is present and what it says. If we cannot find a DKIM selector, we say we did not find one, not that you have none.

Ask your email or domain provider

Which services send mail as our domain (our mail, our newsletter tool, our invoicing)? Are all of them in SPF? Is DKIM switched on for each? Is there a DMARC record, and who reads its reports?

What we do not say

We do not say mail will or will not reach an inbox. Delivery depends on the receiver.

Sources

  1. Google Workspace Admin Help, Email sender guidelines (read on 2026-10-29)
  2. RFC 7208, Sender Policy Framework (SPF), April 2014 (read on 2026-10-28)
  3. RFC 6376, DomainKeys Identified Mail (DKIM) Signatures, September 2011 (read on 2026-10-28)
  4. RFC 9989, Domain-based Message Authentication, Reporting, and Conformance (DMARC) (read on 2026-10-29)

Want us to read your own site? Run the free website scan, or book a free call.

We build it. We look after it.

Free, 30 minutes, no sales deck. We ask about the problem, the goal, and what has been tried. If we fit, you get a fixed-price proposal.