Why your email goes to spam, and what to check first

SPF is a TXT record on your domain that lists which servers may send mail as you. If the server that sent the message is not on the list, receivers treat the mail as suspect.

example.com.  TXT  "v=spf1 include:_spf.yourmailhost.com -all"

• Publish exactly one SPF record. Two records is an error, and receivers then ignore both.
• Every service that sends as your domain must be in it: your mail host, your newsletter tool, your invoicing software.
• Stay under 10 DNS lookups. See the guide on 'too many DNS lookups'.

DKIM adds a cryptographic signature to every message. The public key sits in DNS under a selector, and receivers use it to check that nothing was changed on the way. Unsigned mail is trusted less, and Gmail and Yahoo require it from anyone sending in bulk.

selector1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBg..."

• Use a 2048-bit key. 1024-bit keys still work but are on their way out.
• Each sending service has its own selector and key. Turn signing on in every one of them.

DMARC ties SPF and DKIM to the address people actually see in the From line, and tells receivers what to do when a message fails. Without it, anyone can put your domain in the From line and nothing stops them.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Start with p=none to collect reports, then move to quarantine and reject. The DMARC guide walks through it.

If you run your own mail server, two more things matter. The server's IP address needs a reverse DNS (PTR) record that points to a name, and that name should point back to the same IP. Receivers distrust servers without one.

Then check the IP against the main blocklists, such as Spamhaus. A listed IP gets mail rejected or filtered no matter how good the DNS records are. Listings usually come from a compromised account or a form that someone abused to send spam.

Receiving servers expect mail to arrive over TLS (STARTTLS), with a valid certificate. MTA-STS and TLS-RPT go one step further: they let your domain require encryption for mail sent to you, and report when it fails.

• A sudden jump in volume from a new domain or IP looks like spam. Warm up slowly.
• Links to URL shorteners or to domains with a bad reputation drag a message down.
• If you send newsletters: one-click unsubscribe is required by Gmail and Yahoo for bulk senders, and a spam-complaint rate above 0.3% gets mail filtered.

The free mail check tests points 1 to 5 in one go and says in plain words what to fix.