Why Emails Land in Spam: Understanding SPF, DKIM, and DMARC
In 2024–2026, major inbox providers including Google Workspace (Gmail), Yahoo Mail, and Microsoft Outlook enacted stringent anti-abuse requirements for anyone sending business correspondence or marketing campaigns. Domains missing authenticated records face automated quarantine or silent discard.
1. SPF (Sender Policy)
Lists the IP addresses authorized to send emails under your domain. Prevents spammers from forging the sender address. Must stay under the 10 DNS lookup limit.
2. DKIM (Digital Signature)
Attaches an asymmetric cryptographic signature to outgoing messages. Verifies that emails were not tampered with in transit between your server and the recipient.
3. DMARC (Enforcement)
Tells inboxes what to do if SPF or DKIM fails (p=none for monitoring, p=quarantine for spam folder, or p=reject to block).
Common Email Authentication Errors & How to Fix Them
- Too many DNS lookups (PermError): The SPF RFC 7208 standard restricts SPF evaluation to a maximum of 10 DNS queries. Exceeding this limit causes inboxes to throw a permanent error. Combine or flatten your includes.
- DKIM selector not found: Ensure your selector name (e.g.
default._domainkey.yourdomain.com) matches the selector assigned in your Google Workspace, Microsoft 365, or Mailchimp admin dashboard. - DMARC alignment failed: For DMARC to pass, the domain in the "From" header must match either the SPF domain (envelope sender) or the DKIM signing domain (
d=yourdomain.com).