Why Your Emails Go to Spam (and How to Fix It)
SPF, DKIM, and DMARC explained with the exact DNS records to add, plus the sending practices that keep you in the inbox.
Muhammad Usman
June 30, 2026 · 2 min read
Your app sends a password reset or invoice email and it lands in spam. This is almost never about the words in your email. It is about authentication records your domain is missing. Fixing them takes about 15 minutes.
The three DNS records that matter
- SPF: lists which servers are allowed to send email for your domain
- DKIM: a cryptographic signature proving the email was not altered in transit
- DMARC: tells inboxes what to do when SPF or DKIM fail, and sends you reports
They are all just DNS TXT records. Here is what they look like for a domain sending through a service like Resend or Postmark:
# SPF: only these servers may send as yourdomain.com
TXT @ "v=spf1 include:spf.resend.com ~all"
# DKIM: public key for the signature (provider gives you this)
TXT resend._domainkey "p=MIGfMA0GCSqGSIb3DQEB..."
# DMARC: reject fakes, email me weekly reports
TXT _dmarc "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"How to verify it worked
Send an email to a Gmail address, open it, and click Show original. You should see PASS next to SPF, DKIM, and DMARC:
SPF: PASS with IP 203.0.113.10
DKIM: 'PASS' with domain yourdomain.com
DMARC: 'PASS'Sending practices that protect your reputation
- Send transactional email through a dedicated service, not your own server
- Keep marketing blasts on a separate subdomain like news.yourdomain.com, so a bad campaign cannot poison your password resets
- Always include a working unsubscribe link in marketing email
- Never buy email lists; high bounce rates mark your domain as a spammer
Reputation is per domain and builds over time. Set up the three records on day one and the inbox takes care of itself.
Frequently asked questions
How do I check if SPF and DKIM are set up?+
Send an email to Gmail and use Show original: it displays PASS or FAIL for each. Free tools like MXToolbox also check your domain records directly.
Why do only some of my emails go to spam?+
Inbox providers score each message individually. Missing authentication plus link-heavy content tips the score into spam, while plain messages pass.
What is the difference between SPF and DKIM?+
SPF says which servers may send for your domain. DKIM proves the message content was not modified. Inboxes want both, plus a DMARC policy tying them together.