If your emails keep landing in spam, the fix usually isn't your writing — it's three DNS records most people never set up. Here's what they do.
If your business emails are landing in spam folders, or worse, getting silently rejected before they even arrive, the cause is almost never your writing style — it's three DNS records that tell receiving mail servers your emails are legitimately from you and not a spoofed attacker. Setting them up correctly is one of the highest-leverage 20-minute tasks for any business sending email from its own domain.
SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When another mail server receives an email claiming to be from you@yourdomain.com, it checks your domain's SPF record to see if the sending server is on the approved list. If your hosting provider's mail server isn't listed, or if you're using a third-party service like a marketing platform without adding it to your SPF record, your emails can fail this check and get flagged as suspicious — even though you genuinely sent them.
DKIM (DomainKeys Identified Mail) works differently: it adds a cryptographic signature to every email you send, generated using a private key only your mail server has. The receiving server checks that signature against a public key published in your DNS. If the signature is valid, the receiving server knows the email genuinely came from your domain and wasn't altered in transit. Unlike SPF, which checks the sending server, DKIM verifies the message itself.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the other two together. It's a policy record that tells receiving mail servers what to do if an email fails SPF or DKIM checks — reject it outright, quarantine it (usually meaning spam folder), or just monitor and report. DMARC also lets you receive reports showing who's sending email using your domain, which is how you discover if someone is spoofing your business to send phishing emails.
Why all three matter together. SPF alone can be bypassed by an attacker who controls a different domain but forges your "from" address in a way SPF doesn't fully catch. DKIM alone doesn't tell receiving servers what to do about a failure. DMARC alone has nothing to enforce without SPF and DKIM already in place. Major mailbox providers — Gmail and Yahoo especially, since their 2024 bulk sender requirements — now effectively require all three configured correctly for any domain sending meaningful volumes of email, or deliverability suffers across the board, even for individual, non-bulk messages.
Setting them up. All three are added as DNS TXT records through your domain's DNS management — the exact values depend on your mail provider (whether that's Host Tonic business email, Google Workspace, or another provider, which will give you the specific SPF and DKIM values to publish). Most hosting control panels, including cPanel's Email Deliverability tool, can generate and even auto-install these records for you, checking existing DNS for conflicts along the way.
If you've never touched these records and you send business email from your own domain, checking your current SPF/DKIM/DMARC status takes about two minutes with any free online mail-authentication checker — and fixing what's missing is usually the single biggest deliverability improvement available to a small business.
Deploy your site on NVMe LiteSpeed Cloud Hosting
Experience ultra-fast 99.9% uptime hosting with free SSL, automated daily backups, and 24/7 expert support. Starting at just ৳149/mo.
Written by
Sana Islam
Author at Host Tonic
