Why your emails land in spam: SPF, DKIM and DMARC explained

Emails usually land in spam for one of three reasons: your domain isn't authenticated (SPF, DKIM and DMARC aren't set up or don't line up), your sender reputation is poor because people ignore or report your emails, or you're sending from an address you can't authenticate, such as a Gmail or Hotmail account. Since 2024, Google and Yahoo have required anyone sending 5,000 or more emails a day to their users to have all three records, a one-click unsubscribe and a low spam complaint rate. Fixing authentication is usually an hour's work and makes the biggest single difference.

Key takeaways

• Send marketing email from your own domain, never from a free Gmail, Hotmail or Yahoo address.
• SPF says which servers can send for your domain, DKIM signs each email, and DMARC tells inboxes what to do when checks fail. You need all three.
• Google's bulk sender rules apply once you send 5,000 or more messages a day to Gmail addresses. Yahoo has similar rules, and Microsoft introduced its own for Outlook.com and Hotmail in 2025.
• Keep spam complaints below 0.3% (ideally under 0.1%), and process unsubscribes within two days.
• Authentication gets you through the door. Emailing people who want your emails keeps you in the inbox.

What deliverability actually means

Deliverability is whether your email reaches the inbox, rather than the spam folder or nowhere at all. It's different from "delivery": an email can be accepted by Gmail and still go straight to spam.

Inbox providers decide where to put each email using three main signals:

1. Authentication. Can they prove the email really came from you?
2. Reputation. How have people reacted to email from your domain before: did they open, click, delete unread or report it as spam?
3. Content and list quality. Does the email look like what people signed up for, and are you sending to real, active addresses?

Why you can't send from a Gmail address

If your mailing tool sends with a From address like yourband@gmail.com, the email claims to come from gmail.com but is actually sent from your tool's servers. You can't add authentication records to gmail.com, so the email fails the checks. Providers such as Yahoo publish DMARC policies telling other inboxes to reject mail that claims to be from their domain but didn't come through their servers.

The fix is to buy your own domain (often a few pounds a year) and send from an address on it, such as hello@yourband.co.uk or news@yourpromotions.com.

SPF explained

SPF (Sender Policy Framework) is a DNS record that lists which servers are allowed to send email for your domain. When an email arrives, the receiving server checks whether it came from a server on that list.

An SPF record is a TXT record on your domain that looks like this:

v=spf1 include:_spf.google.com include:spf.your-email-tool.example ~all

• v=spf1 marks it as an SPF record.
• Each include: adds a service allowed to send for you, such as your normal inbox provider and your mailing tool. Your tools will tell you exactly what to add.
• ~all means "treat anything else as suspicious". -all means "reject anything else", which is stricter.

Common SPF mistakes:

• Two SPF records. You can only have one. If you add a second for a new tool, both can fail. Merge them into one record with several include: entries.
• Too many lookups. SPF allows a maximum of 10 DNS lookups. Each include: uses at least one. Remove services you no longer use.
• Assuming SPF is enough. SPF checks the hidden "return path" address used for bounces, not the From address people see. Many mailing tools use their own return path, which is why DKIM and DMARC matter.

DKIM explained

DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send, proving it came from your domain and wasn't altered on the way. Your mailing tool signs each email with a private key, and publishes the matching public key in your DNS so receivers can check the signature.

You don't write DKIM records yourself. Your mailing tool gives you one or more records to add, usually a CNAME or TXT record with a name like:

selector1._domainkey.yourdomain.co.uk

The "selector" part lets you have several DKIM keys for different services. Use 2048-bit keys where your provider offers them; Google requires at least 1024-bit.

The important point: the DKIM signature should be for your domain, not your mailing tool's. If you haven't set up DKIM for your domain, many tools sign with their own domain, and that won't line up with your From address for DMARC.

DMARC explained

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do if an email fails authentication, and sends you reports about who is sending email using your domain.

DMARC passes only if SPF or DKIM passes and the domain it checked lines up with the domain in your visible From address. This is called alignment. By default, alignment is relaxed, so mail.yourdomain.co.uk aligns with yourdomain.co.uk.

A DMARC record is a TXT record at _dmarc.yourdomain.co.uk:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk

• p=none means "monitor only, don't block anything". This is where everyone starts.
• p=quarantine means "put failing emails in spam".
• p=reject means "refuse failing emails altogether".
• rua= is where aggregate reports are sent. Reports arrive as XML files; a DMARC report tool can summarise them.

A sensible path: start at p=none, check reports for a few weeks to make sure everything legitimate passes (your inbox provider, mailing tool, ticketing or invoicing tools that send as you), then move to p=quarantine and eventually p=reject.

The Google and Yahoo rules from 2024

In February 2024, Google and Yahoo started enforcing new requirements for email sent to their users. Some apply to everyone; stricter ones apply to bulk senders.

Who counts as a bulk sender? Google defines it as sending close to 5,000 or more messages to personal Gmail accounts within 24 hours. Once you've hit that, Google treats you as a bulk sender from then on. The rules are good practice at any size.

One-click unsubscribe means the email includes special headers (List-Unsubscribe and List-Unsubscribe-Post) so Gmail and Yahoo can show their own unsubscribe button and remove the person without them visiting a website. Most reputable mailing tools add these automatically; check yours does.

Spam complaint rate is the share of your emails that recipients mark as spam. Google asks bulk senders to stay below 0.3% and recommends staying under 0.1%. You can see your rate for Gmail in Google Postmaster Tools, once you send enough volume.

Microsoft followed in 2025 with similar requirements for domains sending over 5,000 emails a day to Outlook.com, Hotmail and Live addresses: SPF, DKIM and DMARC (at least p=none) aligned with your From domain.

Set it up in an hour: a checklist

1. Get your own domain if you don't have one, and set up a normal mailbox on it.
2. Choose your sending address, such as news@yourdomain.co.uk. Some senders use a subdomain like mail.yourdomain.co.uk for marketing to keep its reputation separate from day-to-day email.
3. Add your mailing tool's SPF include to your existing SPF record (don't create a second one).
4. Add the DKIM records your mailing tool gives you, and verify them in the tool.
5. Set a custom return path or bounce domain if your tool offers one, so SPF aligns too.
6. Publish a DMARC record with p=none and a reporting address.
7. Send a test to a Gmail address, open it, choose "Show original" from the menu, and check that SPF, DKIM and DMARC all say PASS.
8. Set up Google Postmaster Tools for your domain.
9. Review DMARC reports after a few weeks, then tighten the policy.

DNS changes can take a few hours to take effect.

Reputation: the other half of the problem

Perfect authentication won't save emails that people don't want. Inbox providers learn from how recipients behave.

• Email only people who opted in. Bought, borrowed or scraped lists are against PECR in the UK and wreck your reputation, partly because they contain spam traps: addresses that exist only to catch senders who don't get consent.
• Remove hard bounces immediately. Repeatedly sending to addresses that don't exist is a strong negative signal.
• Stop emailing people who never engage. As a rough guide, if someone hasn't clicked in 12 months, send one re-engagement email and remove them if they don't respond.
• Make unsubscribing easy. A hidden unsubscribe link turns "I'm not interested" into "Report spam", which hurts far more. Our guide to unsubscribes and STOP replies covers this.
• Don't overdo frequency. Sudden spikes in volume, or several emails a week to people who didn't expect them, push complaints up. See how often to email your fans.
• Warm up a new domain. Start by emailing your most engaged fans, then increase volume over a few weeks.

Content: what matters and what doesn't

Single "spam words" matter much less than they used to. Use real text rather than one large image, link to your own domain rather than public link shorteners, and use a From name and subject line people recognise. Our list of subject lines for event emails has examples.

For the wider picture of planning and sending campaigns, see our complete guide to email marketing for promoters.

Frequently asked questions

Why are my emails going to spam?

The most common reasons are missing or misaligned SPF, DKIM and DMARC records, sending from a free address like Gmail, and a poor sender reputation from emailing people who don't engage or who report you. Check authentication first using Gmail's "Show original", then look at your bounce and complaint rates.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send email for your domain. DKIM adds a digital signature proving an email came from your domain and wasn't changed. DMARC checks that SPF or DKIM passed for the same domain as your From address, tells inboxes what to do if not, and sends you reports.

Do I need DMARC if I send a small number of emails?

Google and Yahoo only require DMARC for bulk senders, but it's worth setting up at any size. A p=none record costs nothing, has no effect on delivery, and gives you reports showing who is sending email as your domain. It also means you're ready if your list grows past the bulk sender threshold.

What counts as a bulk sender for Gmail?

Google defines a bulk sender as one that sends close to 5,000 or more messages to personal Gmail accounts in a 24-hour period. Once a domain reaches that, Google treats it as a bulk sender permanently. Bulk senders must use SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints below 0.3%.

How do I check if my SPF, DKIM and DMARC are working?

Send an email from your mailing tool to a Gmail address, open it, and choose "Show original" from the three-dot menu. The summary at the top shows PASS or FAIL for SPF, DKIM and DMARC. You can also use free online DNS checkers to look up each record.