Why Your Business Emails Go to Spam (And How to Fix SPF, DKIM & DMARC)

Sending proposals, invoices, or client updates only to find out days later that your email went straight into the recipient's Spam or Junk folder is one of the most frustrating experiences for a business owner.

In early 2024, both Google (Gmail) and Yahoo rolled out strict email authentication mandates. Under these new rules, domains that send unauthenticated emails are flagged, throttled, or outright rejected before they ever reach the recipient's primary inbox.

If you recently registered a domain, changed your DNS host, or set up Google Workspace, Microsoft 365, or Zoho Mail, you must have three foundational DNS security records configured: SPF, DKIM, and DMARC.

In this guide, we break down what each record does and provide exact configuration examples to ensure your business emails land in the primary inbox.

1. SPF (Sender Policy Framework)

What It Does

SPF is a TXT record added to your domain's DNS. It acts as a public guest list that tells mail servers around the world: "These specific servers are authorized to send email on behalf of my domain."

If an email arrives claiming to be from [email protected], the receiving server checks your domain's SPF record. If the sender's IP address is not on that list, the email is flagged as suspicious.

Example SPF Record

Inside your DNS provider (Cloudflare, GoDaddy, Namecheap, Google Domains), create a TXT record:

• Host / Name: @ (or leave blank depending on provider)
• Type: TXT
• TTL: 3600 (or Auto)
• Value for Google Workspace:

  v=spf1 include:_spf.google.com ~all
  

• Value for Zoho Mail:

  v=spf1 include:zoho.in ~all
  

• Value if you send via both Google Workspace and Shopify / SendGrid:

  v=spf1 include:_spf.google.com include:sendgrid.net ~all
  

Warning: You must never have more than one SPF TXT record on a single domain. If you use multiple email services, combine them inside a single v=spf1 ... ~all record. Multiple SPF records cause an automatic permanent error (PermError), causing inbox providers to reject your mail.

2. DKIM (DomainKeys Identified Mail)

What It Does

While SPF verifies the sender's server, DKIM verifies that the email content was not tampered with in transit.

DKIM uses asymmetric cryptographic keys:

1. Your email provider signs outgoing emails with a private cryptographic key.
2. You publish a public key as a TXT or CNAME record in your domain's DNS.
3. The recipient server uses your public key to decrypt the digital signature and confirm the email is authentic and un-modified.

How to Configure DKIM

1. Log into your email admin console (e.g. Google Workspace Admin Console or Zoho Control Panel).
2. Go to Apps > Google Workspace > Gmail > Authenticate email (or Zoho Email Authentication).
3. Click Generate New Record (choose a 2048-bit key).
4. Copy the generated record into your DNS provider:
   • Host: google._domainkey (or your provider's custom selector)
   • Type: TXT
   • Value: A long string beginning with v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BA...
5. Return to your email admin dashboard and click Start Authentication.

3. DMARC (Domain-based Message Authentication, Reporting & Conformance)

What It Does

DMARC links SPF and DKIM together. It gives receiving mail servers explicit instructions on what to do if an incoming email fails SPF or DKIM checks:

• Should the email be delivered normally? (p=none)
• Should it be moved to the recipient's spam folder? (p=quarantine)
• Should it be completely rejected and dropped? (p=reject)

Additionally, DMARC sends daily aggregate reports to your technical email address showing who is sending email from your domain and whether any phishing or spoofing attempts occurred.

Recommended DMARC Starting Record

In your DNS provider, create a TXT record:

• Host / Name: _dmarc

• Type: TXT

• Value:

  v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; aspf=r;
  

• v=DMARC1: Specifies the DMARC version protocol.

• p=quarantine: Instructs mail servers to send failing emails to the Spam folder instead of letting spoofers impersonate your company.

• pct=100: Applies the policy to 100% of emails.

• rua=mailto:...: Specifies where aggregate diagnostic reports should be sent.

4. Testing Your Deliverability Score

Once you have added these records, wait 10 to 30 minutes for DNS propagation, then test your setup using these free verification tools:

1. Mail-Tester.com: Send a test email to the temporary address provided. Aim for a score of 9.5/10 or 10/10.
2. Google Admin Toolbox CheckMX: Paste your domain name into Google's public CheckMX tool to verify that MX, SPF, and DKIM are fully aligned.
3. MXToolbox DMARC Lookup: Confirms that your _dmarc record is syntactically valid and reachable.

Deliverability Checklist for Business Owners

• Domain has a single, valid SPF record with no duplicate TXT tags.
• 2048-bit DKIM key is generated and verified in your mail admin panel.
• DMARC record created with at least p=quarantine or p=none monitoring.
• Reverse DNS (PTR) configured if hosting your own VPS/mail server.
• Custom domain tracking enabled in your CRM or newsletter software.

Need Expert Assistance?

DNS configurations can be daunting—a single misplaced semicolon or duplicate TXT entry can break your team's email flow completely.

At Vellion Group, we handle end-to-end domain setup, DNS hardening, and deliverability protection for businesses across India. Learn more about our Business Email & Domain Setup Services or contact us directly on WhatsApp to get your domain authenticated.

Written by Jay Agarwal

Founder & Lead Developer at Vellion Group. Jay engineers high-reliability AI automations, custom Shopify stores, and scalable apps for businesses in India and worldwide.

Founder Website GitHub LinkedIn