When customers say "I never got the email", the message was often delivered — straight to the spam folder. Mailbox providers like Gmail and Outlook decide where an email goes based largely on whether they can verify who sent it. Three DNS records do that job: SPF, DKIM and DMARC.
The three records in plain language
| Record | What it does | Analogy |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | A guest list at the door |
| DKIM | Adds a digital signature proving the email wasn't altered | A tamper-proof seal on the envelope |
| DMARC | Tells receivers what to do if SPF/DKIM fail, and sends you reports | The policy the security guard follows |
What Gmail and Yahoo require
Since February 2024, Gmail and Yahoo require bulk senders (Google defines these as domains sending around 5,000 or more messages a day to Gmail addresses) to authenticate with SPF and DKIM, publish a DMARC record, offer one-click unsubscribe in marketing emails, and keep spam complaint rates low. Even if you send less, following the same rules improves delivery.
Setting it up: the steps
- List every service that sends email as your domain — your mail provider, website, CRM, invoicing tool and transactional email service.
- Publish one SPF record that includes all of them. A domain should have only one SPF record.
- Enable DKIM in each sending service and add the DNS records it gives you.
- Add a DMARC record starting with a monitoring policy (p=none), review the reports, then move to quarantine or reject once everything legitimate passes.
- Use a separate subdomain for marketing email, so campaign complaints don't hurt your transactional messages.
Other deliverability habits
- Send transactional emails (OTPs, invoices) through a dedicated transactional email service.
- Only email people who asked for it, and remove addresses that bounce.
- Keep a consistent sender name and address.
- Avoid image-only emails and misleading subject lines.
- Monitor bounce, complaint and open rates after every change.
Emails landing in spam? See our email integration service or contact us.
Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send email for your domain, DKIM signs each email to prove it wasn't altered, and DMARC tells receiving servers what to do when those checks fail and sends you reports.
Do I need DMARC if I send only a few emails?
It is strongly recommended. DMARC protects your domain from being spoofed and improves the chance that your legitimate emails reach the inbox.
Why do my OTP emails go to spam?
Common causes are missing or broken SPF/DKIM records, no DMARC policy, sending from a shared or poorly reputed server, or mixing marketing and transactional email on the same domain.
Need help with this?
Our senior team can scope it with you in a free 30-minute call — no salespeople, no pressure.