Why Your Emails Go to Spam: SPF, DKIM, DMARC

If your invoices, order confirmations and password resets are landing in spam, the cause is almost never the wording. It is that the receiving server cannot verify the mail genuinely came from you. Three DNS records fix that, and all three are free.

The problem in one sentence

Anyone can send email claiming to be from your domain. SMTP was designed in a more trusting era and has no built-in proof of identity, so receiving servers look for records you publish in DNS that say which servers are allowed to send on your behalf.

No records, no proof. No proof, spam folder.

SPF — who is allowed to send

SPF (Sender Policy Framework) is a DNS record listing the servers permitted to send mail for your domain. The receiver checks the sending IP against that list.

It is a TXT record on your root domain:

v=spf1 +a +mx +ip4:YOUR.SERVER.IP ~all

cPanel usually creates this automatically. Check it under Email → Email Deliverability.

The mistake almost everyone makes: you can only have one SPF record. If you send through us *and* Google Workspace *and* Mailchimp, they all go in one record — not three separate ones. Multiple SPF records is a hard failure, not a warning:

v=spf1 +a +mx include:_spf.google.com include:servers.mcsv.net ~all

The ~all at the end means "anything else is suspicious but do not hard-reject". Use ~all until you are certain the record is complete; -all rejects outright and will lose real mail if you missed a sender.

DKIM — proof it was not tampered with

DKIM (DomainKeys Identified Mail) signs each outgoing message cryptographically. The receiver fetches your public key from DNS and verifies the signature, proving the message really came from your domain and was not altered.

cPanel generates the key pair for you. Under Email → Email Deliverability, if DKIM shows a problem, click Repair and cPanel installs the record.

If your DNS is hosted elsewhere — at Cloudflare, say — cPanel cannot write the record itself. It will show you the value to copy across manually. This is the most common reason DKIM stays broken: the record was generated but never published where the world can see it.

DMARC — what to do when checks fail

DMARC ties the other two together. It tells receiving servers what to do with mail that fails SPF or DKIM, and where to send reports.

Start permissive:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none means "do not change how you treat failures, just tell me about them". Run that for a few weeks and read the reports — they will reveal senders you forgot about.

Once you are confident everything legitimate passes, tighten to p=quarantine (failures to spam) and eventually p=reject.

Do not start at `p=reject`. You will silently destroy mail from a service you forgot you use.

Checking your work

Under Email → Email Deliverability in cPanel, every domain should show a green tick for both SPF and DKIM. If not, the Repair button fixes most cases automatically.

Then send a real test to a Gmail address you own. Open the message, choose Show original, and look for:

SPF:   PASS
DKIM:  PASS
DMARC: PASS

Three passes means the authentication layer is correct.

If it is still going to spam

Authentication is necessary but not sufficient. If all three pass and mail still lands in spam:

• Check your IP reputation. On shared hosting your IP is shared. If someone else on it was compromised, you inherit the damage — tell us and we will look. A VPS with a dedicated IP removes this class of problem permanently.
• Check content. All-caps subjects, "FREE!!!", a single large image with no text, and link shorteners all score badly.
• Warm up gradually. A brand-new domain sending 5,000 messages on day one looks exactly like a spammer. Build volume over weeks.
• Honour unsubscribes immediately. Complaint rate is the strongest signal there is, and it outweighs everything above.
• Never buy a list. One purchased list can destroy a domain's reputation permanently. There is no repair for this.

The order to do it in

1. Fix SPF — one record, all senders included 2. Fix DKIM — generate in cPanel, publish wherever your DNS actually lives 3. Add DMARC at p=none and read the reports 4. Tighten DMARC once nothing legitimate is failing

Message us on WhatsApp with your domain if Email Deliverability shows a problem you cannot clear — we can read the DNS from our side and usually spot it immediately.