DEV Community

Claudiu Florin Oneata
Claudiu Florin Oneata

Posted on

Why Business Emails Land in Gmail Spam in 2026: Missing _dmarc, SPF & How to Fix It in 2 Minutes

#node #security #webdev #devops

Since Google, Yahoo, and Microsoft enforced strict sender authentication requirements, thousands of companies, clinics, law firms, and SaaS startups have noticed a silent problem: their invoices, proposals, and onboarding emails are landing straight in Gmail and Outlook's Spam folder.

When we scanned over 200 custom domains this week, we discovered two recurring DNS misconfigurations:

  1. No _dmarc TXT record at all, or a passive v=DMARC1; p=none; policy that provides zero anti-spoofing enforcement.
  2. Incomplete SPF records missing third-party senders or ending in ?all instead of ~all / -all.

Here is how to diagnose any domain's email deliverability in 5 seconds and generate the exact DNS records to fix it.

1. Why p=none in DMARC Is No Longer Enough

Many sysadmins set up v=DMARC1; p=none; years ago and forgot about it. Today, receiving mail servers treat p=none as an unmonitored domain open to spoofing.

To build maximum domain reputation with Gmail and Microsoft 365, your _dmarc.yourdomain.com TXT record should enforce at least p=quarantine (with pct=100 and strict/relaxed alignment):

Host: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=quarantine; pct=100; rua=mailto:postmaster@yourdomain.com; fo=1; adkim=r; aspf=r;
Enter fullscreen mode Exit fullscreen mode

And your root SPF record must explicitly authorize your mail provider (Google Workspace, Microsoft 365, Resend, Ionos, etc.):

Host: @
Type: TXT
Value: v=spf1 a mx include:_spf.google.com ~all
Enter fullscreen mode Exit fullscreen mode

2. Run a Free 5-Second DNS Antispam Audit (EmailGuard Pro)

You can test your domain's live MX, SPF, and _dmarc status right now using EmailGuard Pro:

👉 Test Your Domain or Corporate Email on EmailGuard Pro

It queries Google & Cloudflare DNS resolvers in real time, detects your email provider (Google Workspace, Microsoft 365, Ionos, OVH, Zoho), scores your spam risk from 0 to 100, and generates the exact TXT records ready to copy and paste into Cloudflare, GoDaddy, Namecheap, or cPanel.

3. For Developers: Verify Emails & Block Disposable Signups in Node.js

If you are building a SaaS signup flow or B2B outreach pipeline, regex validation (/^[^@]+@[^@]+$/) won't stop disposable burner inboxes (10minutemail, guerrillamail, yopmail) or dead domains without MX records.

We published two production REST APIs on RapidAPI (with a generous Free Tier of 50–100 requests/month):

A. EmailGuard Pro API (MX, SPF, DMARC & Disposable Detector) 

const res = await fetch(
  'https://emailguard-pro-email-verification-and-disposable-detector.p.rapidapi.com/api/verify-email?email=founder@stripe.com',
  {
    headers: {
      'X-RapidAPI-Key': process.env.RAPIDAPI_KEY,
      'X-RapidAPI-Host': 'emailguard-pro-email-verification-and-disposable-detector.p.rapidapi.com'
    }
  }
);
const data = await res.json();
console.log(data.deliverable, data.isDisposable, data.dnsSecurity);
Enter fullscreen mode Exit fullscreen mode

🔗 Get a Free API Key for EmailGuard Pro on RapidAPI

B. LeadExtract B2B API (Extract Contacts, Social Links & Tech Stack from Any Domain) 

const res = await fetch(
  'https://leadextract-b2b-company-contacts-and-tech-stack-scraper.p.rapidapi.com/api/extract-company?url=https://vercel.com',
  {
    headers: {
      'X-RapidAPI-Key': process.env.RAPIDAPI_KEY,
      'X-RapidAPI-Host': 'leadextract-b2b-company-contacts-and-tech-stack-scraper.p.rapidapi.com'
    }
  }
);
const company = await res.json();
console.log(company.contacts, company.techStack);
Enter fullscreen mode Exit fullscreen mode

🔗 Explore LeadExtract B2B API on RapidAPI

Top comments (0)