Your emails landing in spam? SPF, DKIM and DMARC – simply explained

A customer says: “Your quote email never arrived.” And you know for sure that you sent it. Sound familiar?

Then it's often not down to you, but to missing records in your domain. Email is old and was built when everyone on the internet still trusted each other. In theory, anyone can enter any sender. So that mailboxes can tell genuine emails from fake ones, there are three verification methods: SPF, DKIM and DMARC.

The three checks in one sentence each

All three are records in your domain's DNS – the internet's address book. You can't see them, but every major email provider reads them with every incoming email.

Why this matters right now

The big mailbox providers have tightened the rules. Since February 2024, Google has required all senders to Gmail to have at least SPF or DKIM, plus an encrypted connection and valid DNS records. Anyone sending more than 5.000 emails a day needs SPF, DKIM and DMARC, as well as one-click unsubscribe for marketing emails. Microsoft has followed suit for Outlook.com, Hotmail and Live: since 5 May 2025, emails from bulk senders that fail the checks are rejected – with an error message, not just sorted into spam.

You don't send 5.000 emails a day? Then the strictest rules don't apply to you. But the checks still factor into how every email is rated. Without SPF and DKIM, even a single quote email ends up in spam more quickly. In Germany, the BSI (Federal Office for Information Security) recommends all three methods in its Technical Guideline on email authentication (TR-03182).

How to check where you stand

Send an email to a Gmail or Outlook mailbox and open the message's detail view there, usually “Show original” or “Message details”. It shows “PASS” or “FAIL” for each of SPF, DKIM and DMARC. If it says PASS everywhere, the foundation is in place. If it says FAIL anywhere or something is missing, it's worth looking at the DNS settings.

Typical stumbling blocks:

• You don't just send from your mailbox, but also via a newsletter tool, shop, invoicing software or ticket system. Each of these services must be listed in SPF or get its own DKIM keys.
• There are two SPF records instead of one. Mail servers really don't like that.
• DMARC is missing entirely. Start with “p=none”: that way you observe first before getting stricter.
• The DKIM key is too short. Google requires at least 1.024 bits and recommends 2.048 bits.

Tighten up step by step

DMARC has three levels: “none” (just observe), “quarantine” (send suspicious emails to spam) and “reject” (refuse them). Jumping straight to “reject” sometimes locks out your own invoicing software. The smarter way: start with “none”, read the reports for a few weeks, add all genuine senders and then tighten things up step by step. In the end, you also protect your customers, because fraudsters can then hardly use your domain for fake invoices any more.

And what if something still ends up in spam?

Clean records are the entry ticket, but not the whole party. Mailboxes also assess the content and your domain's reputation. A few things that often help:

• Don't send group emails to hundreds of recipients from your normal mailbox; use a newsletter service with an unsubscribe link instead – and only send to people who have agreed.
• Avoid subject lines in capital letters, lots of exclamation marks and emails that consist of nothing but an image.
• Send large attachments as a link to a secure download instead.
• Keep an eye on your spam rate: Google sets the limit at 0,3 per cent complaints – ideally stay well below that.

If an important email still disappears, the error message that often comes back helps. It looks cryptic, but usually contains the reason in one line. Just forward it – for us it's like an X-ray.

DNS sounds like a basement with no lights? The Email Monster sets up SPF, DKIM and DMARC for you, checks all sending services and explains the result in two sentences. For everything around your domains, the Domain Monster is there to help.