Why your business emails land in spam, and how SPF, DKIM and DMARC fix it

“Sorry, your email went to my spam folder.” If you hear that from customers, the problem is rarely what you wrote. Much more often, your domain isn’t proving that your emails are genuinely from you.

Why proving it matters now

Email was designed with no way to check who really sent a message, which is why scam emails can pretend to come from your bank. Three standards fix that, and the big email providers now expect them:

• From February 2024, Google and Yahoo began requiring every sender to authenticate their email, and anyone sending large volumes (5,000 or more messages a day to Gmail) to have SPF, DKIM and DMARC all in place.
• From 5 May 2025, Microsoft began enforcing similar requirements for high-volume senders to Outlook.com, Hotmail and Live addresses.

Even if you don’t send anything like those volumes, messages from a domain without these records are treated with more suspicion, and are more likely to be filtered.

What each record does

• SPF (Sender Policy Framework) is a list of the servers allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every message, proving it hasn’t been changed and really came from your domain.
• DMARC tells receiving servers what to do with email that fails those checks, and sends you reports so you can see who is sending email using your domain name.

The most common mistakes

• Two SPF records. A domain can only have one. If you use more than one sending service, such as your hosting and a newsletter platform, they must be combined into a single record.
• Forgetting third-party senders. Your website’s contact form, your accounting software and your newsletter tool may all send email as you. Each needs to be covered.
• Jumping straight to a strict DMARC policy. Start with p=none, read the reports, fix anything that fails, then tighten it.

How to fix it

If your domain and email are hosted with Fusionhost, cPanel’s Email Deliverability tool sets up SPF and DKIM for you in a couple of clicks, and adding DMARC takes one more record. Our step-by-step guide covers it: setting up SPF, DKIM and DMARC.