Emails Are Landing in Spam ?Fix It in 10 Minutes...

If you've ever sent an email from your own domain and had it disappear into a customer's spam folder, this post is for you.

Since 2024, Gmail and Yahoo have enforced strict authentication requirements for anyone sending email even low volume. If your domain's SPF, DKIM, and DMARC records aren't set up correctly, your emails don't just risk landing in spam. Increasingly, they get rejected outright.

Here's what these three things actually do, and how to check if yours are set up right.

The Three Records That Decide If Your Email Is Trusted
SPF (Sender Policy Framework)

A DNS record that lists which mail servers are allowed to send email on behalf of your domain. Think of it as a guest list if a server isn't on it, receiving mail servers get suspicious.

v=spf1 include:_spf.google.com ~all

DKIM (DomainKeys Identified Mail)
A cryptographic signature attached to every email you send, proving it wasn't altered in transit and genuinely came from your domain. This is set up through your email provider (Google Workspace, SendGrid, etc.) and published as a DNS record.

DMARC (Domain-based Message Authentication, Reporting & Conformance)
The policy that tells receiving servers what to do if an email claims to be from your domain but fails SPF or DKIM. Without DMARC, someone could spoof your exact domain and there'd be no policy in place to stop it.

v=DMARC1; p=quarantine; rua=mailto:[e-mail]

Why This Actually Matters (Not Just Technical Trivia)

1. No DMARC = anyone can send phishing emails that appear to come from your company, and there's no policy stopping it.
2. Weak SPF (missing your actual sending servers) = your own real emails start bouncing or landing in spam.
3. Misconfigured DKIM = signature verification fails silently, and you won't know until deliverability drops.

The frustrating part: most founders and small teams set this up once, early on, and never check it again even as they add new tools (a new CRM, a new transactional email service) that also need to be included in these records.

How to Check Yours Right Now

You can look up your own records manually using dig or an online DNS lookup tool, but reading the raw output and knowing what "good" looks like takes some practice.

If you want a faster read, I built a small tool that does this in one call and also tells you what's actually wrong (not just "SPF: present" the exact DNS record to add if something's missing): Email Authentication Compliance API. Compliance API. Free tier gives you the raw SPF/DKIM/DMARC/MX detection; no signup walls to just check a domain.

The One-Line Takeaway

If you're sending email from your own domain — for your product, your marketing, anything — check your SPF/DKIM/DMARC setup today, not after something breaks. It takes less time than reading this post.