Emails Going to Junk? A Simple Guide to SPF, DKIM and DMARC

SPF, DKIM and DMARC are DNS records that prove email sent from your domain really came from you. Without them, anyone can send email pretending to be your business, and mail providers can’t tell your real emails from fake ones.

Why your emails are going to junk

Mail providers now enforce these records:

• Gmail and Yahoo (since February 2024): every sender needs SPF or DKIM. Anyone sending more than 5,000 emails a day needs SPF, DKIM and DMARC.
• Outlook, Hotmail and Live (since May 2025): the same rules for high-volume senders, with failing mail sent to junk and rejection to follow.

Mail that fails these checks is marked as spam or rejected. Even if you send far less than 5,000 a day, providers trust authenticated mail more, so a domain without all three is more likely to land in junk.

Check your domain

These free tools only read your domain’s public DNS records, so it’s safe to enter your domain:

• Google Check MX: Google’s own checker. Best if you use Google Workspace.
• MxToolbox Email Health: works with any email provider.
• Learn and Test DMARC: send it a test email and it shows whether SPF, DKIM and DMARC passed.

Get help from ChatGPT or Claude

AI assistants are very good at walking you through this. Open our ready-made prompt in ChatGPT or Claude and add your domain at the end. It will ask about your setup, then give you the exact records to add, step by step.

Before you change anything: list every service that sends email as your domain, not just your mailbox. Marketing platforms like Mailchimp or HubSpot, your website’s contact forms, booking systems and invoicing software often do. If one is missing from your records, its emails will start going to junk or bouncing once DMARC is tightened.

Run the checkers above again afterwards to confirm everything passes.

The technical details

Record	What it does	Example
SPF	Lists the services allowed to send email for your domain	v=spf1 include:_spf.google.com ~all
DKIM	Signs every email so receivers can confirm it wasn’t forged or changed	A public key published at google._domainkey
DMARC	Tells receivers what to do with email that fails, and sends you reports	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.au

To fix it:

1. SPF: have one SPF record only. Include your email provider (include:_spf.google.com for Google Workspace, include:spf.protection.outlook.com for Microsoft 365) and any other service that sends as you, such as your website or newsletter tool. Remove providers you no longer use.
2. DKIM: turn it on in your email provider’s admin console and add the record it gives you to your DNS. Do the same in any other service that sends as you.
3. DMARC: add a TXT record named _dmarc, starting with p=none so nothing is blocked while you review the reports. Once all your real email passes, move to p=quarantine, then p=reject. p=reject is what stops others spoofing your domain.

Official set-up guides:

• Google Workspace: SPF · DKIM · DMARC
• Microsoft 365: SPF · DKIM · DMARC

Source: Google’s email sender guidelines.