SPF, DKIM and DMARC Explained: Why Site Emails Land in Spam
SPF, DKIM and DMARC are three email checks that prove a message really comes from the domain it claims. When they are missing or wrong, receiving mail systems may send your messages, including website contact-form emails, to spam or reject them. All three are set up as text records in your domain settings.
Why email is easy to fake
Email was designed in a more trusting time, and the sender address on a message can be written by anyone. Criminals use this to pretend to be banks, shops and colleagues. Mail systems protect their users by checking whether a message really comes from where it says. If your domain gives them no way to check, they must guess, and they often guess against you.
SPF: who may send for your domain
SPF is a published list of the servers allowed to send mail for your domain. When a message arrives, the receiving server compares the sending server with the list. A helpful picture is a staff directory: a message from an unlisted sender is suspicious. If you send from your mailbox provider, a newsletter tool and a website form service, all of them should be on the list.
DKIM: a signature on every message
DKIM adds a cryptographic signature to outgoing mail. The signing key is private and stays with the sender, and the matching public key is published in your domain settings. The receiving server uses the public key to check that the message was signed by the domain and was not changed on the way.
DMARC: what to do when checks fail
DMARC sits on top of the other two. It tells receivers what to do with a message that fails SPF or DKIM: deliver it anyway, put it in quarantine or reject it. It can also ask receivers to send you reports, which show who is sending mail in your name and whether it passes. A common approach is to start in monitoring mode, read the reports, fix legitimate senders and tighten the policy later.
Where the records live
All three are stored as text entries in the DNS settings of your domain. DNS is the system that connects your domain name to the services behind it, and you manage it where you registered the domain or at the company that handles your name servers. The records are visible to anyone, which is why receivers can read them. The records do not enforce anything on their own. Mail servers must read and apply them.
How to check whether a message passed
- Send a test email from your site or mailbox to an address you control.
- Open the message and choose the option to show the original or the message details.
- Search the technical header for SPF, DKIM and DMARC. A result of "pass" means the check succeeded.
- If any check says fail or none, look at the records for that sender.
How to set them up
Your email provider and your site tools usually publish instructions with the exact values to add. The steps are the same in every case: open the DNS settings of the domain, add the text records exactly as given, save, and wait for the change to spread, which can take from minutes to a few hours. Do not assume that your hosting service has configured them for you. Even a domain that never sends mail should publish a DMARC record, so nobody can easily pretend to be it.
Why site contact-form emails go to spam
A common cause is that the form sends mail from a server that is not on your SPF list, using your own domain as the sender. The receiving system sees a message that claims to come from you but originates somewhere else, and treats it as suspicious. The fix is to send form messages through your mailbox provider or a trusted sending service, add that service to SPF and enable its DKIM signing. If the messages go to your own address, a simpler option is to deliver form submissions to a chat or inbox that does not depend on your domain, as discussed in the form spam guide.
Common mistakes
- Publishing two separate SPF records instead of combining them into one.
- Forgetting a service that sends mail for you, such as a newsletter tool.
- Setting DMARC to reject before checking the reports, which can block your own legitimate mail.
- Editing DNS without a note of the old values. Write them down first, as you would before any site change, see the backup guide.
Email and account security
Authentication records protect your domain's reputation, but not your inbox. Protect the account itself with a strong password and two-step sign-in, as described in the security basics guide.
FAQ
Do I need all three?
For good delivery, yes. They work together: SPF and DKIM prove the sender, and DMARC tells receivers what to do with failures.
Why do my form emails go to spam?
Often the sender is not authorized for your domain. Send through an authorized service and check the records.
How long do DNS changes take?
From a few minutes to several hours. Check again after a while before changing anything else.
What happens if I set DMARC to reject?
Messages that fail the checks are refused. Use it only after the reports show that all legitimate senders pass.
Can I test my setup for free?
Yes. Send a test to a mailbox that shows message details and read the results, or use a free record checker.
Your next step: send an email from your site to your own address, open the message details and read the three results. Fix the first one that does not pass.