SPF record missing? Fix email landing in spam

1. Missing or incorrect SPF record

This is the number one reason your email lands in spam. I've seen it ruin deliverability for small businesses and big companies alike. SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are allowed to send email for your domain. Without it, your email looks like it could be spoofed.

Here's the fix. You need to add a TXT record to your domain's DNS. But you can't just paste any old record. Get it wrong and you'll block your own mail or leave yourself open to attackers.

Find your sending sources

You need to know every server that sends email from your domain. For most people, that's:

• Your web hosting company's SMTP server (e.g., cPanel or Plesk)
• Microsoft 365 or Google Workspace if you use them
• Third-party email services like Mailchimp, SendGrid, or Constant Contact
• Your own on-premise mail server's public IP

Log into your domain's DNS management panel (usually at your domain registrar or hosting provider). Look for the DNS record editor.

Build the SPF record

A basic SPF record looks like this:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ip4:192.0.2.100 ~all

Let me break that down:

• v=spf1 — the version tag. Always start here.
• include:spf.protection.outlook.com — this lets Microsoft 365 send email for your domain. Replace with Google's include:_spf.google.com if you use Workspace.
• include:sendgrid.net — third-party service. Add one include per service.
• ip4:192.0.2.100 — your own mail server's public IP.
• ~all — soft fail. This says "if the sender isn't listed, mark it as suspicious but don't reject it." I use ~all while testing. Switch to -all (hard fail) after you're sure all your sources are listed.

Add the TXT record. For the host/name field, use @ or your bare domain (e.g., example.com). TTL can stay at default (3600 seconds is fine).

After you click save, wait. DNS propagation takes anywhere from 5 minutes to 48 hours. For most domains, I see it go live within 15 minutes.

Test your SPF record

Once saved, check it with a free tool like MXToolbox's SPF lookup. It should show your record and tell you if there are any syntax errors. Common gotchas:

• You can only have one SPF record per domain. If you already have one, edit it. Don't add a second.
• The total DNS lookup limit is 10. Each include counts as one lookup. If you have more than 10, the record is invalid and won't be used. Combine or remove unused includes.
• No spaces inside the record except after v=spf1. That trips people up all the time.

2. Missing DKIM signature

SPF alone isn't enough. DKIM (DomainKeys Identified Mail) adds a digital signature to each email. It proves the email wasn't tampered with in transit. If you're missing DKIM, your email gets a lower reputation score, and Gmail especially will treat it with suspicion.

Set up DKIM for Microsoft 365

If you use Microsoft 365, here's how:

1. Go to the Microsoft 365 Defender portal (security.microsoft.com).
2. Go to Email & collaboration > Policies & rules > Threat policies.
3. Click DKIM under the Email authentication section.
4. Select your domain. Click Create DKIM keys.
5. Microsoft generates two CNAME records you need to add to your DNS. They look like selector1._domainkey.yourdomain.com and selector2._domainkey.yourdomain.com.
6. Add both CNAME records to your DNS. Set TTL to 3600.
7. Back in Defender, click Enable for the domain.

After you enable it, you can test by sending an email and checking the headers. Look for dkim=pass or dkim=signature.

Set up DKIM for Google Workspace

Google handles this differently:

1. Go to Google Admin console (admin.google.com).
2. Go to Apps > Google Workspace > Gmail.
3. Click Authenticate email.
4. Click Generate new record. Google shows a TXT record value.
5. Add that TXT record to your DNS under google._domainkey.yourdomain.com.
6. After DNS propagates, click Start authentication in the admin panel.

Google's DKIM takes longer to activate — sometimes up to 48 hours. Don't panic if it doesn't work immediately.

3. No DMARC policy set

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do when both SPF and DKIM fail. Without a DMARC policy, spammers can still send email that looks like it's from your domain, and you'll never know. DMARC also gives you reporting so you can see who's trying to abuse your domain.

Add a DMARC record

This is another DNS TXT record. The host is _dmarc.yourdomain.com. The value should be:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

That's the safest starting point. Here's what each part means:

• v=DMARC1 — version. Always this.
• p=none — policy. none means "monitor only". You won't block anything. Once you're confident everything works, change to p=quarantine (send failing email to spam) or p=reject (block it entirely).
• rua=mailto:... — where to send aggregate reports. Use a mailbox you check. You'll get XML reports showing who sent email using your domain.

After you add the record, wait for DNS propagation. Then check with MXToolbox's DMARC lookup tool. It should show your policy as p=none and no syntax errors.

I recommend leaving it on p=none for at least two weeks. Check the reports. If you see legitimate email failing, fix your SPF or DKIM before tightening the policy.

One more thing. If you use a shared hosting provider like GoDaddy or Bluehost, they might already have SPF records for their own IP ranges. Check with their support before adding yours. Overlapping or duplicate records cause more problems than they solve.

Lastly, test your email deliverability with a service like Mail-Tester.com. Send an email to the address they give you, then check your score. Aim for 10/10. If it's lower, the report tells you exactly what's wrong. That's your next step.