Why are our emails going to spam? SPF, DKIM and DMARC explained
If booking confirmations or newsletters from your organisation keep landing in spam, three settings on your domain are usually the reason: SPF, DKIM and DMARC.
The three settings in plain English
- SPF is a list of the services allowed to send email as your domain.
- DKIM is a digital signature that proves an email really came from you and wasn't changed on the way.
- DMARC tells receiving inboxes what to do when an email fails those checks, and sends you reports about it.
All three are records you add in your domain's DNS settings, usually at your registrar or web host. Microsoft describes them as building blocks that work together, so you want all three.
What the big inboxes require
- Gmail: every sender must set up SPF or DKIM. Anyone sending about 5,000 or more messages a day to personal Gmail accounts must have SPF, DKIM and DMARC.
- Outlook.com, Hotmail and Live: Microsoft requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to its consumer services.
- Yahoo: all senders need SPF or DKIM, and bulk senders need all three.
Most small organisations send far fewer than 5,000 a day. But inboxes still check, and email that passes all three is much less likely to look suspicious.
Setting them up, step by step
- List everything that sends email as you. Your main mailbox (Google Workspace or Microsoft 365), plus your newsletter tool, booking system, invoicing software and website contact form. This is the step people miss.
- SPF: create one SPF record that includes every sender on your list. Each service's help pages give you the part to add. You can only have one SPF record per domain. Two records break it.
- DKIM: turn it on in each service. Each one gives you DNS records to add, then you switch signing on.
- Wait. Google suggests allowing 48 hours after setting up SPF or DKIM before adding DMARC.
- DMARC: start with a policy of "none", which only monitors, and send reports to a dedicated mailbox.
- Tighten it later. Once the reports show your real senders all pass, move to "quarantine" and then "reject".
Worked example (made up)
A small charity uses Microsoft 365 for email, a newsletter tool and an online booking system. Its SPF record starts from Microsoft's standard value, v=spf1 include:spf.protection.outlook.com -all, and adds one include each for the newsletter tool and the booking system. It sets up DKIM in all three. Two days later it adds a DMARC record, v=DMARC1; p=none; rua=mailto:dmarc@ followed by its domain. A month of reports shows the invoicing tool was also sending as the charity and failing, so they add that too, then move to quarantine.
Common mistakes
- Two separate SPF records, often added by two different suppliers.
- Too many includes. SPF fails if checking it needs more than 10 DNS lookups.
- Jumping straight to "reject" and blocking your own newsletter.
- Setting up DKIM for your mailbox but not your newsletter or booking system.
Google Workspace and Microsoft 365 both publish step-by-step guides. If you're choosing a booking system, ask whether it can send from your own domain with DKIM. Our guide to booking system costs covers other questions worth asking.
Sources
- Google: Email sender guidelines
- Microsoft: Fix NDR error 550 5.7.515 in Outlook.com (high-volume sender requirements)
- Yahoo: Sender best practices
- Google Workspace: Set up DMARC
- Microsoft: Set up SPF for Microsoft 365
Related
← Who owns your organisation's domain name? A ten-minute check