Short answer: whether mail from your own domain lands in the inbox or the spam folder is decided largely by three small DNS records (settings on your domain) — SPF, DKIM and DMARC. They prove a message really came from you. Since 2024 Gmail and Yahoo require them from bulk senders, and Outlook joined in 2025 — but they quietly help every sender, including a small business that sends a dozen invoices a day.
We set these up for every client domain at onboarding, so here’s the plain-language version: what each record does, what the big mailbox providers now demand, and how to check your own domain.
Why your mail goes to spam in the first place
Email was built without a way to prove who sent a message. Anyone can put you@yourcompany.com in the From: line — that’s how phishing works. So mailbox providers (Gmail, Outlook, Yahoo) lean on authentication: if your domain can’t prove a message is really from it, the safe bet is the spam folder. Three records provide that proof.
The three records, in plain language
SPF (Sender Policy Framework) — a DNS record listing which servers are allowed to send mail for your domain. The receiver checks the sending server against the list. If your real mail server isn’t on it, the message looks forged.
DKIM (DomainKeys Identified Mail) — a cryptographic signature added to every message (Yahoo and others require at least a 1024-bit key). The matching public key lives in your DNS. It proves the message wasn’t altered in transit and really came from an authorised sender.
DMARC (Domain-based Message Authentication) — the policy on top. It tells receivers what to do when SPF or DKIM fail — nothing (p=none), send to spam (quarantine), or reject (reject) — and where to send reports so you can see who’s sending as you. It also enforces alignment: the visible From: domain must match the SPF or DKIM domain.
You need all three. SPF and DKIM do the proving; DMARC ties them to your visible address and sets the rule.
What changed — and the thresholds
The big providers turned best practice into requirements:
- Gmail and Yahoo — since February 2024, senders of 5,000+ messages a day to their users must have SPF, DKIM and DMARC, a working one-click unsubscribe, and keep their spam-complaint rate under 0.3%. (Google, Yahoo)
- Outlook / Microsoft — for domains sending 5,000+ a day, the same SPF + DKIM + DMARC requirement; from May 2025 non-compliant mail went to Junk, and Microsoft has since moved to outright rejection. (Microsoft)
Honest note for small businesses: the hard mandate kicks in at 5,000/day, which most SMBs never hit. But the same authentication signals are used to judge all mail. A domain with no SPF, no DKIM and no DMARC looks suspicious whatever the volume — so these records matter even if you send ten emails a day.
How to check and fix your domain
- Check what you have now: a free tool like MXToolbox, or the providers’ own Postmaster Tools, will show whether SPF, DKIM and DMARC exist and pass.
- Add the records to your DNS. SPF and DMARC are TXT records; DKIM is published by whatever sends your mail (your mail server, Google Workspace, Microsoft 365, your newsletter tool) and you add its key.
- Start DMARC at
p=none(monitor only) and read the reports for a couple of weeks before tightening toquarantineorreject.
A few records, easy to get subtly wrong
These are only a few DNS lines, but they’re easy to break quietly: an SPF record that’s too broad, a too-strict DMARC that blocks your own newsletter, or a missing alignment that silently fails. Done wrong, you can send your real mail to spam yourself.
That’s the part we handle: on our managed hosting we set up SPF, DKIM and DMARC for your domain, point the reports somewhere useful, and tighten the policy without cutting off your real mail. If your invoices keep landing in spam, that’s the fix.