My emails go to spam: SPF, DKIM and DMARC

Q: How do I know if my SPF and DKIM are set up correctly?

Send an email to a Gmail address, open it, then choose Show original . Gmail shows PASS or FAIL for SPF, DKIM and DMARC.

Q: Which DMARC value should I start with?

v=DMARC1; p=none is the recommended starting value: it turns on DMARC without blocking any message. You can tighten it later, once you are sure all your emails pass the checks.

Understand why your messages end up in junk folders and how to authenticate your domain.

Updated October 23, 2026·4 min read

In short

If your emails go to spam, first check that your domain publishes three TXT DNS records: SPF (which authorises the sending server), DKIM (the signature of your messages) and DMARC (the anti-spoofing policy). For a domain connected in External domains, Upkyo shows the exact values to copy. Then review the content of your messages.

You send a quote or an invoice and your customer only finds it in their junk folder? Gmail, Outlook and other email services filter messages whose origin they cannot verify. Three DNS records are used to prove that your messages really come from you: SPF, DKIM and DMARC. This guide explains what they do, how to check them on your domain and what other causes can send your emails to spam.

Why do my emails go to spam?

The most frequent causes are:

the domain is not authenticated: SPF, DKIM or DMARC are missing or badly written;
the content looks like spam: subject line in capitals, lots of links, a single large image, words like "free" or "urgent";
the reputation is weak: a new domain, a sudden burst of messages, or a hacked mailbox that has sent spam;
the recipient does not know you: a first exchange, or an address never marked as safe.

Authenticating the domain is the starting point: without it, other efforts have little effect.

What are SPF, DKIM and DMARC?

SPF: who is allowed to send?

SPF is a TXT record on your domain that starts with v=spf1. It lists the servers allowed to send emails on your behalf. When Gmail receives a message from contact@yourdomain.com, it checks that the server that sent it is on that list.

DKIM: has the message been altered?

DKIM adds a digital signature to every email sent. The key used to verify this signature is published in a TXT record, for example default._domainkey.yourdomain.com. If the signature is valid, the recipient knows the message really comes from your domain and was not altered on the way.

DMARC: what to do when checks fail?

DMARC is a TXT record named _dmarc.yourdomain.com that starts with v=DMARC1. It tells email services what to do with a message that fails the SPF and DKIM checks: nothing special (p=none), quarantine it (p=quarantine) or reject it (p=reject). Gmail and Yahoo now require DMARC for senders who send in bulk.

Check your records step by step

Open your domain's DNS zone: in Domains, click the domain, then the DNS tab if it is managed at Upkyo (see Edit your DNS records), or in your registrar's interface if it is managed elsewhere.
Find the TXT record starting with v=spf1 on the main domain. There must be only one.
Find the DKIM TXT record, named default._domainkey.
Find the TXT record named _dmarc, starting with v=DMARC1.
If one is missing, add it with the exact value provided by Upkyo, then wait for propagation, see Why is my DNS change not visible yet?.
Send a test message to a Gmail address and open the Show original option: the SPF, DKIM and DMARC lines should say PASS.

Where to find the right values at Upkyo?

For a domain registered elsewhere and connected in External domains, the domain page shows the SPF, DKIM and DMARC lines to copy at your registrar, with their progress (see Use Upkyo Mail with a domain bought elsewhere). The DKIM line appears as soon as your first email address is created on that domain. The suggested DMARC value is v=DMARC1; p=none: a monitoring policy, with no risk of blocking your own emails.

For a domain managed at Upkyo, check in the DNS tab that these three records are present. If you are unsure about a value, open a ticket: support will give you the exact values for your domain.

If you also send newsletters, the sending tool must be authorised too. For Upkyo's Campaigns space, see Authenticate your sending domain.

Common mistakes

Two SPF records: this is an error, even if each one is correct. Merge them into a single v=spf1 … ~all that lists all your sending services.
SPF too long: beyond ten DNS lookups (the include: mentions), SPF fails. Remove services you no longer use.
DKIM copied incompletely: the key is long, and one missing part is enough to invalidate the signature.
DMARC too strict too soon: jumping straight to p=reject can block legitimate emails from a forgotten service. Start with p=none.
Domain name doubled: at some registrars, enter _dmarc and not _dmarc.yourdomain.com.

Good practices to stay in the inbox

Write clear subject lines, without capitals or repeated exclamation marks.
Balance text and images, and limit the number of links.
Ask regular correspondents to add your address to their contacts.
Protect your mailboxes with strong passwords: a hacked mailbox sending spam ruins the domain's reputation, see Change a mailbox password.

Frequently asked questions

How do I stop my emails from going to spam?

Authenticate your domain with SPF, DKIM and DMARC, take care with the content of your messages and avoid bulk sending from a regular mailbox. Check the result with Gmail's Show original option.

How do I know if my SPF and DKIM are set up correctly?

Send an email to a Gmail address, open it, then choose Show original. Gmail shows PASS or FAIL for SPF, DKIM and DMARC.

Which DMARC value should I start with?

v=DMARC1; p=none is the recommended starting value: it turns on DMARC without blocking any message. You can tighten it later, once you are sure all your emails pass the checks.

Why do my emails go to spam in Gmail but not elsewhere?

Gmail is stricter: it requires SPF or DKIM for everyone, and DMARC for bulk senders. A single missing record is often enough to explain the difference.