Business email going to spam? Fix SPF, DKIM, and DMARC

If email from your business domain keeps landing in other people’s spam folders, the first thing to check is email authentication. Receiving providers check three DNS records, SPF, DKIM, and DMARC, to decide whether a message really came from you. Fix them in that order, confirm every service that sends mail as your domain is covered, then check blocklists and complaint rates. The rest of this guide walks through each step with example records.

This post is about outbound mail, the messages you send. If your problem is junk arriving in your own inbox, see our guide to inbound spam filtering instead.

Why does legitimate email get flagged as spam?

Email was designed without any proof of identity. Anyone can type your address into the From line. To cope with that, Gmail, Yahoo, and Microsoft now look for technical proof that a message is authorized by the domain it claims to come from. Mail without that proof is treated with suspicion, and in some cases it is refused outright.

Three records in your domain’s DNS (the public settings that tell the internet where your website and email live) provide that proof:

• SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message so the receiver can confirm it was not forged or altered.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do when a message fails SPF and DKIM, and sends you reports about who is sending mail in your name.

How to check where you stand in five minutes

1. Send a message from your business address to a personal Gmail account.
2. Open it in Gmail on a computer, select the three dots at the top right of the message, and choose Show original.
3. Look at the SPF, DKIM, and DMARC lines. Each should say PASS, and the domain shown next to DKIM should be your own domain, not your email provider’s.

Repeat the test from every system that sends mail as you: your website contact form, invoicing or accounting software, your CRM, your newsletter tool, and the office copier if it scans to email. Staff mailboxes can pass while one of these other senders fails.

Step 1: set up SPF

SPF is a single TXT record at the root of your domain. For a business that sends only through Microsoft 365, Microsoft documents this record:

Host:   @  (example.com)
Type:   TXT
Value:  v=spf1 include:spf.protection.outlook.com -all

For Google Workspace only, Google’s SPF guide gives:

v=spf1 include:_spf.google.com ~all

What each part means:

• v=spf1 identifies the record as SPF.
• include: authorizes another service’s servers. Each extra sender (a newsletter platform, for example) gives you its own include: value to add.
• ip4: or ip6: authorizes a specific IP address, used mainly for an on-site mail server.
• -all (hard fail) says nothing else is authorized. ~all (soft fail) says anything else is probably not authorized. Microsoft recommends -all once DKIM and DMARC are also in place.

Two rules trip people up. First, a domain can have only one SPF record. If you add a second one for a new service, SPF returns an error and both stop working, so merge everything into a single record. Second, SPF allows a maximum of 10 DNS lookups. Each include: uses at least one, and nested includes use more. Go over the limit and SPF fails for every message.

Step 2: turn on DKIM

Your mail is probably already signed, but by default it is signed with your provider’s domain rather than yours. DMARC needs the signature to match your own domain, so this step matters.

Microsoft 365: in the Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, open the DKIM tab, and select your domain. Microsoft shows two CNAME records to create at your DNS host. In Microsoft’s DKIM instructions they look like this:

Host:       selector1._domainkey
Type:       CNAME
Points to:  selector1-example-com._domainkey.example.n-v1.dkim.mail.microsoft

Host:       selector2._domainkey
Type:       CNAME
Points to:  selector2-example-com._domainkey.example.n-v1.dkim.mail.microsoft

Copy the exact values from your own portal because part of the address is unique to your account, and older accounts use an onmicrosoft.com format instead. Once the records are live, switch the toggle to Enabled.

Google Workspace: in the Admin console, go to Apps > Google Workspace > Gmail > Authenticate email, generate a new record (choose a 2048-bit key if your DNS host supports it), and publish the TXT record it gives you at google._domainkey. Google notes it can take up to 48 hours for DKIM to start working after you add the key.

Step 3: publish a DMARC record

DMARC is a TXT record at _dmarc.example.com. Start in monitoring mode:

Host:   _dmarc
Type:   TXT
Value:  v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The tags, as defined in RFC 7489 and explained in Microsoft’s DMARC guide:

Tag	Meaning
v=DMARC1	Identifies the record as DMARC. Required, and must come first.
p=	The policy for mail that fails: none (take no action, just report), quarantine (treat as spam), or reject (refuse it).
rua=	Where daily aggregate reports are sent. Use a shared mailbox or a DMARC reporting service, not a person’s inbox.
pct=	The percentage of failing mail the policy applies to. Defaults to 100. Useful for a gradual rollout.
sp=	An optional separate policy for subdomains. Without it, subdomains inherit p=.
adkim= and aspf=	How strictly the DKIM and SPF domains must match your From domain: r (relaxed, the default, subdomains count) or s (strict).

A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the domain in the From line. That matching is known as alignment, and it is where third-party senders can fail: the newsletter tool passes SPF for its own domain, not yours. The fix is to set up custom DKIM signing (and, where offered, a custom return path) inside that tool so it signs as your domain.

What Gmail, Yahoo, and Outlook.com now require

All three large consumer mailbox providers have published sender rules. The strictest tier applies to bulk senders, but the baseline applies to everyone.

Provider	All senders	Bulk senders (about 5,000+ messages a day)
Gmail	SPF or DKIM, valid forward and reverse DNS, TLS encryption, spam rate below 0.3% in Postmaster Tools	SPF and DKIM, a DMARC record, From domain aligned with SPF or DKIM, one-click unsubscribe on marketing mail
Yahoo	SPF or DKIM, valid forward and reverse DNS, spam rate below 0.3%	SPF and DKIM, DMARC of at least p=none that passes, one-click unsubscribe honored within 2 days
Outlook.com, Hotmail, Live	The published rules target high-volume senders; normal spam filtering applies to everyone	SPF and DKIM passing, DMARC of at least p=none aligned with SPF or DKIM

Google’s rules took effect on February 1, 2024, and Google’s sender FAQ describes stepped-up enforcement from November 2025. Microsoft began enforcing its rules on May 5, 2025, and rejects non-compliant bulk mail with the error 550 5.7.515 Access denied, sending domain does not meet the required authentication level.

Most small offices send far fewer than 5,000 messages a day to any one provider. The bulk tier still matters if you run a newsletter or send invoices and reminders at volume, and the practical answer is the same either way: publish all three records.

How to move DMARC from p=none to p=reject

p=none satisfies the published minimums, but it does not stop anyone from forging your domain. The goal is p=reject. Microsoft recommends a gradual path:

1. Publish p=none with a rua address. Reports start arriving within a day or two as XML attachments. A DMARC reporting service turns them into readable tables.
2. Review reports weekly. List every source sending as your domain. Fix each legitimate one by adding it to SPF or turning on custom DKIM. Ignore unknown sources that fail, since those are the forgeries DMARC exists to block.
3. Move to p=quarantine. You can ease in with pct=10, then 25, 50, 75, and 100, checking reports at each step.
4. Move to p=reject once legitimate mail passes consistently.

There is no official timetable. A few weeks of clean reports at each stage is a sensible pace for a small office with a handful of sending services. Microsoft also suggests sending bulk or marketing mail from a subdomain such as news.example.com, so a problem with a marketing platform does not affect the reputation of staff email.

Check blocklists and Google Postmaster Tools

If authentication passes and mail still goes to spam, look at reputation.

• Blocklists. The Spamhaus lookup tool checks whether a domain or IP address is listed. If you send through Microsoft 365 or Google Workspace you share their sending IPs, so an IP listing is rarely about you, but a domain listing is. A bounce from a Microsoft 365 recipient that mentions 5.7.606 to 5.7.649 means the sending IP is on Microsoft’s blocked senders list, and Microsoft’s delist portal handles removal requests.
• Google Postmaster Tools. Postmaster Tools is free. You verify your domain with a DNS record, then see Gmail’s view of your compliance status, spam complaint rate, and authentication results. Google notes that dashboards may show no data when your volume to personal Gmail accounts is low, which is normal for a small office.
• Complaints. The 0.3% spam rate limit means three complaints per 1,000 delivered messages. Only email people who asked to hear from you, and make unsubscribing easy.

Common mistakes

• Two SPF records on the same domain.
• More than 10 DNS lookups in SPF after adding several services.
• DKIM left on the provider’s default domain, so DMARC alignment fails.
• Jumping straight to p=reject before checking reports, which blocks your own invoices or website form.
• Sending business mail from a free @gmail.com or @yahoo.com address. You cannot authenticate a domain you do not own.
• Forgetting parked domains. For domains you own but never send from, Microsoft recommends publishing v=spf1 -all and v=DMARC1; p=reject; so nobody else can use them.

When authentication is not the problem

Authentication proves who you are. It does not make unwanted mail wanted. A brand-new domain with no sending history, a purchased contact list, or a sudden jump in volume can all land in spam with perfect records. Forwarded mail and mailing lists can also break SPF and DKIM through no fault of yours. If everything passes and a single recipient still never sees your mail, ask them to check their own quarantine and safe sender settings.

Common questions

Do I need all three records if I only send a few emails a day?

Yes. Gmail and Yahoo require at least SPF or DKIM from every sender, and DMARC is what protects your domain from being forged in phishing aimed at your customers. The three records cost nothing to publish and are set up once, with occasional updates when you add a new sending service.

How long do DNS changes take to work?

It depends on your DNS host and the time to live (TTL) set on each record. Microsoft recommends a TTL of at least one hour on SPF records, and Google says DKIM can take up to 48 hours to become active after you publish the key. Plan on testing the day after you make changes, then again two days later.

Will DMARC stop spam coming into my inbox?

No. DMARC protects your domain name when other people receive mail claiming to be from you. Filtering what arrives in your own mailboxes is a separate job, covered in our spam filtering guide and our guide to spotting phishing emails.

What does a DMARC reporting service cost?

Pricing varies by vendor and by how much mail you send, so compare current plans before choosing. Microsoft points to the Microsoft Intelligent Security Association catalog for DMARC reporting vendors. The reports themselves are free: receivers send them to whatever address you put in rua, and you can read the raw XML yourself, though it is slow going.

How Coastal Growth Co. can help

We set up and repair SPF, DKIM, and DMARC for small businesses on Microsoft 365 and Google Workspace, including tracking down every service that sends mail as your domain and moving DMARC to enforcement in stages. It is part of our cloud and email work and a standard item when we review a Microsoft 365 setup. Domain forgery is also a common ingredient in business email compromise, so the fix pays off twice. Tell us what is happening and we will agree on scope and price before any paid work starts.