BG, Bulgarian version of this pageFree auditSend an enquiry

Email and automation

Why do your company's emails land in spam, and how do SPF, DKIM and DMARC fix it?

The ScaleLab teamPublished 9 min read

In short: Company emails often land in spam because the domain does not prove they really come from the company. Three DNS records provide that proof: SPF says which servers may send from your domain, DKIM signs every message, and DMARC says what should happen to messages that fail the check. Gmail and Microsoft require all three from senders of around 5,000 or more emails a day, and Gmail also watches spam complaints and easy unsubscribing.

Why do good emails end up in spam?

Mailbox providers cannot trust the name in the “From” field. Anyone can type your company’s address there. So Gmail, Outlook and the rest check whether a message was really sent from a server your domain has authorised, and whether its content was changed along the way.

When that check fails, the message looks like a phishing attempt. The result is the spam folder or an outright rejection. The problem is rarely the wording of the email. Far more often it lies in the domain set-up, especially when a company sends from several places: staff mailboxes, a newsletter tool, an online shop, an invoicing system, a CRM.

Each of these systems sends mail in your name. If one of them has not been added to the domain’s records, its messages fail the check. That is the difference between a company whose order confirmations reach the customer and one whose customers ring up to ask where the email went.

What do SPF, DKIM and DMARC actually do?

The three records work together, and each answers a different question:

  • SPF (Sender Policy Framework): a list of the servers and services allowed to send email from your domain. The receiving server compares the sending server against that list.
  • DKIM (DomainKeys Identified Mail): a digital signature the sending system adds to every message. The receiver checks the signature with a public key published in DNS and so knows whether the message was altered.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): a policy that tells the receiver what to do with messages that fail SPF or DKIM, and where to send reports about them.

DMARC also adds one important condition: alignment. It is not enough for a message to pass SPF or DKIM for any domain at all. The domain in the “From” field must match the domain verified through SPF or through DKIM.

Record What it checks Where it lives Typical mistake
SPF Whether the server may send for the domain TXT record in the domain’s DNS A second, separate SPF record or more than 10 DNS lookups
DKIM Whether the message is signed and unaltered TXT record with a public key in DNS The newsletter tool signs with its own domain, not yours
DMARC What happens to failing messages and where reports go TXT record at _dmarc on the domain A p=reject policy set before every sender has been checked

The SPF rules are strict: a domain must not have several SPF records, and mechanisms that need DNS lookups (such as include) are limited to 10. When the company adds a new service, it goes into the existing record, not a new one.

What do Gmail and Microsoft require?

As of September 2026, the two largest mailbox providers set clear requirements for high-volume senders. Check the current terms, as they are updated over time.

Gmail. A bulk sender is anyone who sends close to 5,000 or more messages a day to personal Gmail accounts. This status does not expire, even if volume drops later. From bulk senders Gmail requires:

  • Authentication: SPF, DKIM and DMARC. DMARC may use p=none, but the domain in “From” must align with the SPF or DKIM domain.
  • Technical basics: a valid reverse DNS (PTR) record for the sending server and a TLS connection.
  • One-click unsubscribe: for marketing and promotional mail, through the List-Unsubscribe header. Gmail recommends honouring unsubscribes within 48 hours.
  • A low spam rate: below 0.1%, and never reaching 0.3%.

Since November 2025 Gmail has been stepping up enforcement: messages that do not meet the requirements face temporary and permanent rejections.

Microsoft. Since 5 May 2025, senders of more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses need SPF, DKIM and DMARC with at least p=none, aligned with SPF or DKIM. Non-compliant messages are rejected rather than sent to the junk folder.

What does this mean for your business? Even if you send fewer than 5,000 emails a day, the same checks are used to assess every message. The thresholds decide when the requirements become mandatory, not when the set-up starts to matter.

ScaleLab tip: Before you touch DNS, list every system that sends email in your name. Search your team’s inboxes for messages from the website, the shop, invoicing and the CRM, and check which address each one comes from.

How do you set up the domain step by step?

1. Gather every sender

Write down each service that sends from the domain: staff email, newsletter tool, shop, website forms, accounting system. Without this list, the next steps are guesswork.

2. Set up SPF

Create one TXT record that includes every sender on the list. Each service gives the exact text to add in its help documentation. Check that there is only one record and that it stays within the limit of 10 lookups.

3. Turn on DKIM for each service

In every sending tool, look for the domain authentication setting. It gives you records to add to DNS. Your messages are then signed with your domain rather than the service’s, and they pass DMARC alignment.

4. Publish DMARC at p=none

Start with a p=none policy and an address for reports (rua). At p=none, receivers deliver messages as before but send daily aggregate reports showing which messages pass and which fail. You see the problems without risking genuine mail.

5. Read the reports and tighten gradually

Reports arrive as XML files and can be numerous at higher volumes, so a service that summarises them helps. Once every legitimate sender has passed for several weeks, move to p=quarantine (messages go to spam) and then to p=reject (messages are refused). Some services still support the pct tag, which applies the policy to a share of messages first. The current DMARC standard (RFC 9989, May 2026), however, removes pct and introduces a test mode, t=y, in which receivers do not apply the policy. Check what your DNS provider and reporting service support.

6. Add Postmaster Tools

Add and verify your domain in Google Postmaster Tools. It has a compliance status dashboard for Gmail’s requirements, a spam rate dashboard, and data on authentication, encryption and delivery errors. Dashboard data is typically updated within 24 hours, though it can take longer, and the compliance status dashboard can take up to 7 days to reflect a fix. So do not expect results the next day.

ScaleLab tip: Do not move to p=reject simply because it “feels safer”. Do it when the reports show that all your systems pass. Otherwise the first thing you block may be your own invoices or confirmations.

How does this affect newsletters and automated emails?

Newsletters and campaigns are where the requirements bite first. They are marketing mail, so one-click unsubscribe applies. They reach many people at once, so every spam complaint counts. And they are often sent from an external tool that must be authenticated with your domain.

Automated emails carry a different risk. Order confirmations, reminders and follow-ups after an enquiry matter to customers, but they are sent by systems the team rarely thinks about. If such a system is not in SPF and does not sign with DKIM, its messages will start being rejected as soon as DMARC gets stricter. That is why, when building marketing automation, checking the domain belongs among the first steps, not the last.

The spam rate also depends on the list. Send only to people who signed up, remove addresses that bounce, and do not hide the unsubscribe link. Someone who cannot find how to unsubscribe presses the spam button instead.

Domain authentication has a security side too. DMARC at p=reject makes it harder to use your domain in phishing emails to customers and partners. For companies that fall under the new cybersecurity rules, this is part of the wider picture described in the NIS2 requirements.

What should you check every month?

The set-up is not a one-off job. Any new service, hosting move or newsletter tool can break it. Our recommendation is a short monthly check:

  1. Is there a new system sending from the domain, and has it been added to SPF and DKIM?
  2. What do the DMARC reports show: any unknown sources, or legitimate mail that fails?
  3. What is the spam rate in Postmaster Tools, and is it below 0.1%?
  4. Does one-click unsubscribe work, and is it processed promptly?
  5. Are there delivery errors that point to an authentication problem?

We recommend starting with the domain and senders, then sorting out the list and content, and monitoring delivery every month alongside email results. To see how automated email sequences are tied to customer actions and measured, look at our email marketing and automation service.

Frequently asked questions

Do I need SPF, DKIM and DMARC if I send only a few emails?

Yes, it is recommended. The threshold of around 5,000 messages a day decides when Gmail and Microsoft make the requirements mandatory. Mailbox providers still use the same checks to assess every message, so small senders benefit from a correct set-up too.

Which DMARC policy should I start with?

Start with p=none and a reporting address. This policy does not change delivery, but it shows which systems pass and which fail. Move to p=quarantine and then p=reject once the reports have shown for several weeks that every legitimate sender passes.

What spam rate does Gmail accept?

Gmail wants the rate below 0.1% and never reaching 0.3%. Monitor it in the spam rate dashboard in Google Postmaster Tools. Bear in mind that the data is not real time: it is typically updated within 24 hours, though it can take longer.

What is one-click unsubscribe?

It is a mechanism where the mailbox provider shows an unsubscribe button and sends the request straight to the sender’s system, without the person opening a web page. Gmail requires it for marketing mail from bulk senders and recommends processing unsubscribes within 48 hours.

Sources

Related articles

  • Email and automation

    How do you build marketing automation, and what should you automate first?

    Marketing automation is built in order: map the customer's path first, bring the data together in one place, and only then choose software. Start with the steps where delay costs customers, such as replying to a new enquiry. Setting up your email domain is part of the system too, because Gmail and Microsoft require bulk senders to authenticate.

    9 min read

  • Cybersecurity

    NIS2 requirements: is your company in scope, and where do you start?

    With the amendments to the Cybersecurity Act of February 2026, NIS2 requirements cover many mid-sized companies in sectors such as manufacturing, food, ICT and healthcare, and indirectly their suppliers too. Significant incidents are reported with an early warning within 24 hours, a notification within 72 hours and a final report within one month of the notification, and management carries personal responsibility. Start by checking scope, listing your assets and assessing risk.

    9 min read