SPF, DKIM, and DMARC: Why Your Email Goes to Spam

The problem they solve

Email was built in a more trusting time. Out of the box, anyone can put your address in the "from" line of a message they send. Scammers do exactly that.

So mail providers like Gmail and Outlook got suspicious. They now look for proof that an email really came from who it claims. SPF, DKIM, and DMARC are that proof. Get them right and your email arrives. Get them wrong and it can go to spam, or let someone impersonate you.

You don't need to understand the technical details. You just need to know what each one does.

SPF: who's allowed to send

SPF is a list, published for your domain, of the servers allowed to send email as you. When a message arrives, the receiver checks: "Did this come from a server on the approved list?"

It works like a guest list at the door.

DKIM: a tamper-proof seal

DKIM adds an invisible digital signature to each message you send. The receiver checks the signature to confirm two things: the email really came from your domain, and nobody changed it along the way.

It's the email version of a wax seal on an envelope.

DMARC: what to do with fakes

DMARC ties the first two together. It's your instruction to receivers: "If a message claiming to be from me fails these checks, here's what to do with it" - ignore the failure, send it to spam, or reject it outright.

DMARC can also send you reports showing who is sending email using your name. That's how you find out if someone is impersonating your business.

Why you should care

Without these set up, two things can happen. Your own legitimate email is more likely to get filtered into spam, where customers never see it. And scammers have an easier time sending fake invoices or messages that look like they came from you.

Both are bad for a small business that runs on trust.

You probably won't set these up yourself

These live in technical settings for your domain, and your email provider or web person usually handles them. Some providers turn them on automatically; many don't.

The useful thing you can do is ask the question: "Are SPF, DKIM, and DMARC set up for my domain?" If the answer is a blank stare, that's worth following up on.

You don't have to configure them yourself. You just have to make sure someone has.