Why your business email lands in spam: SPF, DKIM and DMARC explained

By Angus Lewington, Alien IT · Last updated: 14 August 2026

Few things quietly cost a business more than email that does not arrive. Quotes that never land, invoices that vanish into a client's junk folder, replies that never come because your message was never seen. Nine times out of ten the cause is not your words or your server, it is three little records on your domain that prove your email is genuinely from you. They are called SPF, DKIM and DMARC, and when they are missing or wrong, the world's mail systems treat your business like a stranger. Here is what each one does, in plain English, and how to put them right.

Last updated 14 August 2026. We review this guide every six months, and after any significant change to how the major mail providers enforce authentication.

You can diagnose all of this without any special access, but you cannot fix it without control of your domain's DNS. Checking what you currently publish takes a browser and a few minutes. Changing it means signing in wherever your domain is registered or where its DNS is hosted, which is often a different company from your email provider and sometimes a web designer who set it up years ago. Find out who holds that access before you plan the work, because it is the step most likely to stall everything else.

The real problem: mail servers cannot tell it is you

Email was built in a trusting age, when anyone could put any name on a message and it would be believed. Scammers abused that for decades, so the receiving mail systems, the ones at the big providers your customers use, got strict. Now, before they will trust a message, they want proof that it genuinely came from the business it claims to be from.

SPF, DKIM and DMARC are how a domain provides that proof. When they are set correctly, your mail arrives with a clean bill of health and drops into the inbox. When they are missing, incomplete, or contradict each other, the receiving server cannot verify you, shrugs, and files your message in spam or refuses it entirely. Your email is not being punished for what it says. It is being doubted for who it says it is from.

The three records, in plain words

Think of getting an email delivered like getting a parcel past a careful security desk. Three things get you waved through:

• SPF is the permit. It is a list, published on your domain, of which mail servers are allowed to send email as your business. When a message arrives, the receiver checks: did this come from a server on the permitted list? If yes, good. If it came from somewhere not on the list, that is a red flag.
• DKIM is the tamper-proof signature. It adds a hidden, cryptographic signature to every message you send. The receiver checks the signature and learns two things: that the message really came from your domain, and that nobody altered it on the way. A valid signature is hard proof of authenticity.
• DMARC is the rulebook. It ties SPF and DKIM together and tells receivers what to do when a message fails the checks: let it through, send it to spam, or reject it. It also sends you reports on who is sending mail as your domain, which is how you catch both misconfiguration and impersonation.

A permit, a signature, and a rulebook. Individually helpful. Together, they are what a modern mail system needs to trust you.

You need all three, in the right order

The most common half-fix I see is a business that set up SPF years ago and stopped, and cannot understand why mail still lands in spam. SPF alone is no longer enough. DKIM alone leaves gaps. And DMARC does nothing on its own, because it depends on the other two being in place first. Reliable delivery needs all three working together and agreeing with each other.

Order matters, too, and this is where a rushed attempt can backfire. Get SPF and DKIM correct first and confirm they are passing. Only then introduce DMARC, gently, watching its reports, before tightening its rule. A strict DMARC policy switched on before SPF and DKIM are solid can reject your own legitimate email, which is a worse problem than the one you started with. Done in sequence it is safe and transformative. Done as a hopeful guess, it can silence your own outbox.

Why it can go wrong all of a sudden

A frequent, baffling version of this is email that worked fine for years and then suddenly starts bouncing or landing in spam. Nothing changed at your end, so why now? Because the receivers keep raising their standards. Mail that scraped through under the old rules gets caught the moment a big provider tightens its threshold, and they do that regularly. A new email service, a marketing or booking tool sending messages on your behalf, or simply the industry moving on can all be the trigger.

The cause is different but the cure is the same: get SPF, DKIM and DMARC properly aligned so your mail passes the stricter checks it now faces. If your mail is already being outright rejected or blacklisted, that is the acute end of the same problem, and it is worth treating with some urgency because every bounced message is a lost conversation.

How to check what you actually have

Before changing anything, find out what your domain publishes today. Guessing is what produces the half-fixes described above, and all three records are public, so anyone can read them.

1. Read the headers of a message you sent. This is the most direct answer available and it costs nothing. Send yourself a message at an outside address, open it, and view the original or the message source. Near the top you will find the authentication results, stating plainly whether SPF passed, whether DKIM passed, and whether DMARC passed. That single block tells you where you stand better than any amount of theorising.
2. Look up your SPF record. It is a TXT record on your domain beginning with v=spf1. Check that every service which sends mail on your behalf is represented in it.
3. Look up your DMARC record. It lives on _dmarc followed by your domain, and begins with v=DMARC1. If nothing is published there, you have no DMARC at all, whatever anyone has told you.
4. Confirm DKIM is signing. The headers check in step one answers this: if DKIM is absent from the authentication results, your mail is not being signed.

The faults that cause most of the trouble

When mail is landing in junk despite records existing, it is usually one of a short list:

• More than one SPF record. A domain may publish only one. Two, typically because a second was added when a new service was set up rather than merged into the existing one, makes the check fail rather than pass twice. This is the most common self-inflicted fault we find.
• Too many lookups in SPF. The specification allows a limited number of DNS lookups when evaluating a record, and every include: for another provider consumes some. Businesses that have accumulated a mail provider, a marketing platform, a booking system and an accounting package can quietly exceed it, at which point the record stops working entirely even though it looks correct.
• A service that was never added. Anything sending as your domain needs to be authorised: the marketing platform, the invoicing software, the website contact form, the booking system. Mail from an unlisted sender fails, which is exactly what SPF is designed to do.
• DMARC tightened too early. Publishing a policy of quarantine or reject before SPF and DKIM are genuinely passing tells the world to junk or refuse your own legitimate mail. Start at monitoring only, read the reports for a few weeks, and tighten once the reports are clean.
• Records that still describe an old provider. After changing email systems the old entries frequently survive. This is the standard cause of a business finding its mail in junk folders a week or two after moving its email to Microsoft 365.

If mail is being refused outright rather than filtered, the bounce message names the reason directly, and a DMARC rejection is unmistakable once you know the wording. Reading the bounce code will tell you in a couple of minutes which of the faults above you are looking at. And if the problem is mail not arriving to you rather than from you, that is a different diagnosis, covered in why Outlook is not receiving emails.

When you land on a blocklist: why you got listed

Sometimes the problem goes beyond filtering. If your mail started bouncing or vanishing everywhere at once, rather than with one difficult recipient, your domain or your sending server has probably been added to a blocklist, a shared database of senders flagged for spamming that receiving systems consult on every delivery. Nobody tells you when you are added. And a listing is never random: something has been sending spam that traces back to you, and nearly every case comes down to one of five causes.

• A compromised mailbox. The most common cause by a wide margin. A staff password gets phished and the account starts pumping out spam in the background. Look in Sent Items for messages nobody remembers writing, review the recent sign-in activity on the account, and before you do anything else change the password and turn on multi-factor authentication.
• A marketing blast. A newsletter sent in one go to a large list that has not been touched in years. Enough recipients hit the spam button, or enough dead addresses bounce, and the blocklists take note. A listing that appears the day after a send is telling you exactly what happened.
• An infected machine. A computer in the office quietly sending spam through malware while it looks perfectly normal to whoever is using it. Scan every machine on the network, not just the obvious suspect, and keep going after the first infection turns up, because there is often more than one.
• Bad hosting neighbours. On cheap shared hosting, your website's mail leaves from the same server as mail from hundreds of strangers. When one of them spams, the shared IP address is listed and every business on it is caught in the blast. The listing is not your fault, but it will keep recurring until your mail is moved somewhere with a clean reputation.
• Missing authentication. This is where the blocklist problem meets everything above. A domain without SPF, DKIM and DMARC is easy to forge, scammers forge it, and the resulting mess is charged against your reputation. The records this guide covers close that door.

Getting delisted: cause first, form second

Every major blocklist runs a removal process, and for standard delisting the big ones do not charge. Look up your listing, which will usually tell you roughly why you are on there, confirm the problem behind it is genuinely fixed, and then request removal. In that order it normally goes through quickly, often within a day or two. In the reverse order, with the cause still live, you are relisted within days, and blocklists remember repeat offenders, which makes the second listing harder to shift than the first.

A warning for while you are searching: you will find paid "blacklist removal services" promising fast results. Most of them submit the same free form you could have submitted yourself, fix nothing, and leave you both relisted and out of pocket. Anyone guaranteeing removal for a fee before asking what caused the listing is telling you all you need to know.

After delisting: rebuild your reputation gently

Removal from the list gets your mail moving again, but it does not restore trust. Mail providers score senders continuously, and a domain fresh off a blocklist is watched closely, so the worst possible next step is a triumphant blast to your entire database. Return to normal one-to-one email first, then bring bulk sending back gradually over a couple of weeks.

Keep the list clean while you do it. Remove addresses that bounce, drop subscribers who never open anything, and never send to a purchased list. Bought lists are riddled with dead addresses and spam traps, addresses that exist to catch exactly this kind of sending, and one send to a list like that can undo the whole recovery.

What this quietly costs, and why it is worth fixing

The insidious thing about email deliverability is that it fails silently. Nobody tells you your quote went to their junk folder. The client simply goes with whoever replied, and you never learn you were in the running. A business can lose work for months to a spam-folder problem it does not even know it has. That is what makes this worth a proper look even when nothing seems obviously broken.

A blocklist listing sharpens all of that. While you are listed, quotes and invoices simply do not arrive, and customers quietly conclude they are being ignored, because nobody rings to say a message went to junk. Then the workarounds start: staff sending from personal accounts to get something out the door, which looks unprofessional and scatters business records across mailboxes the business does not control. A listing that takes a day to fix properly can cost weeks if it is left to drift, so treat it as seriously as you would a dead phone line.

Email sits alongside your other business foundations, and it deserves the same care. If you are tightening up how your business runs online, it pairs naturally with getting your backups right and your cyber security in order, because authenticated email is as much a security measure as a delivery one: the same records that get your mail into inboxes also make it far harder for a scammer to impersonate your business to your own customers.

FAQ

Why does my business email keep going to spam?

Usually because the receiving mail systems cannot confirm your email genuinely came from you. Three records, SPF, DKIM and DMARC, are how a domain proves that. If they are missing, wrong, or incomplete, mail servers treat your message as suspicious and file it in spam or block it outright. Getting all three set correctly is what moves your mail back to the inbox.

What are SPF, DKIM and DMARC in plain English?

They are three settings on your domain that together prove your email is really you. SPF lists which servers are allowed to send email as your business. DKIM adds a tamper-proof signature to each message. DMARC ties the two together and tells receivers what to do if a message fails the checks. Think of them as a permit, a signature, and a rulebook.

Which one do I need? Do I need all three?

You need all three working together for reliable delivery. SPF alone helps but is not enough, and DKIM alone leaves gaps. DMARC only works once SPF and DKIM are in place, because it depends on them. Setting up one or two and stopping is the common half-measure that leaves mail still landing in spam. The three are a set.

My email suddenly started bouncing or getting blocked. Why now?

Receivers have steadily tightened their rules, and mail that squeaked through for years can suddenly be rejected once a threshold changes. A new email service, a marketing tool sending on your behalf, or simply a big provider raising its standards can be the trigger. The fix is the same: get SPF, DKIM and DMARC properly aligned so your mail passes the stricter checks.

Can setting these up wrong make things worse?

Yes, which is why care matters. A too-strict DMARC rule set before SPF and DKIM are fully correct can cause your own legitimate email to be rejected. The safe approach is to get SPF and DKIM right first, watch the reports, then tighten DMARC gradually. Done in the right order it is safe; done as a rushed guess it can block your own mail.

How do I get my domain off an email blacklist?

Find and fix the cause first, then request removal. The major blocklists run free removal processes: look up your listing, confirm the problem behind it is genuinely fixed, and submit the request. Done in that order, removal usually goes through within a day or two. Done with the spam still flowing, you are relisted within days, and blocklists remember repeat offenders.

Should I pay a blacklist removal service?

No. The major blocklists do not charge for standard delisting, and most paid removal services simply fill in the same free form without fixing anything, so the listing comes back and the fee is wasted. Put that effort into finding the cause, most often a compromised mailbox or an infected machine.

Can Alien IT fix our email deliverability?

Yes, it is one of the most common things we sort for businesses. We check what is set on your domain, fix the SPF, DKIM and DMARC records so your mail is properly authenticated, and confirm delivery improves. If your business email is landing in spam or bouncing, that is a fixable problem, and it is worth fixing because it quietly costs you replies you never knew were missed.

The bottom line

If your business email lands in spam or bounces, it is almost never your writing and almost always your authentication. SPF proves which servers may send as you, DKIM signs each message so it cannot be faked or altered, and DMARC ties them together and tells receivers how to judge the rest. Set all three, in the right order, and your mail goes from doubted stranger to trusted sender. Leave them half-done, and you keep losing conversations you never even see.

Email landing in spam, bouncing, or blacklisted? We will check what is set, fix the records properly, and get your mail back in the inbox. Tell us what is happening with your email and we will sort it, no jargon.