Guides

Why emails land in spam: SPF, DKIM, and DMARC

18 October 2026

A missing or broken SPF, DKIM, or DMARC setup is a real reason mail is rejected or filed as spam. It is one reason. Gmail and Yahoo also weigh complaints, list quality, and reputation. Checking the DNS records tells you whether the domain is authenticated. A DNS check is not an inbox-placement test.

What each record is allowed to prove

SPF publishes which hosts may use a domain in the SMTP MAIL FROM and HELO identities. A pass means the connecting host was on that list. It says nothing about the message body.

DKIM lets the owner of a signing domain claim responsibility for a message. The verifier fetches the public key from that domain’s DNS. Selectors (s=) let one domain publish more than one key at once. DKIM separates the signer from the person the From header claims to be. A valid signature shows the signed content was not altered after signing, and that the signer’s domain published the key.

DMARC is the policy on the domain in the visible From header. A message satisfies DMARC when at least one of SPF or DKIM produces a pass on an identifier that aligns with that From domain. The RFC is explicit about the limit: DMARC does not grant authenticated mail a better shot at the inbox, and it does not check the local-part of the address or the legitimacy of the content.

Missing, failing, and erroring

These are different results, and mailbox providers do not treat them as the same hint.

No SPF record at all is the result none. That is not a fail. Google still says mail that is not authenticated with the methods on its sender guidelines may be marked as spam or rejected with a 5.7.26 error.
SPF permerror means the record could not be evaluated. Two v=spf1 records at the same name do this. So does crossing ten DNS lookups. A PermError is not a pass.
SPF fail and softfail both mean the host was not authorized. Only a pass can satisfy DMARC’s SPF half.
DKIM fail means the signature did not verify: the key was missing, the body or headers changed, or the selector was wrong. Google requires a DKIM key of 1024 bits or longer for mail to personal Gmail accounts, and recommends 2048 when the DNS host allows it. Yahoo requires 1024 bits or greater and recommends 2048.
DMARC fails when neither SPF nor DKIM produced an aligned pass. With p=none, you asked receivers to take no specific action. With p=quarantine, you asked them to treat the mail as suspicious. With p=reject, you asked them to reject it. Yahoo says a p=reject domain’s mail is rejected when it lacks a proper DKIM signature or SPF alignment.

RFC 7489 says one aligned, verifying DKIM signature is enough for a DMARC pass, even if the message carries other signatures. Yahoo’s FAQ adds an operator caveat: if several DMARC-aligned signatures are present and they do not all pass, Yahoo does not guarantee the message will pass DMARC.

Alignment, and a From domain that does not match

DMARC compares the authenticated domain with the domain in the From header. Relaxed mode is the default (adkim=r, aspf=r, or the tags omitted). Relaxed mode passes when both names share an organizational domain, so news.example.com can align with example.com. Strict mode (adkim=s or aspf=s) requires the full host names to match.

A valid DKIM signature from some other domain does not authenticate your From domain. The RFC says that directly: a signature can come from a mailing list or from anyone else, so the signature alone is not enough.

Two patterns show up constantly on store domains:

SPF passes on a bounce or return-path domain the ESP owns, while the From header is your brand. If those names do not share an organizational domain, SPF does not align, and DMARC’s SPF result is a fail even though the raw SPF check passed.
DKIM verifies with d= set to the ESP’s domain, while the From header is yours. The signature is real. It does not align. The fix is the DKIM selector that ESP tells you to publish on your domain, so a signature verifies as you.

Google’s bulk-sender rule states the same requirement in operator language: for direct mail, the domain in the From header must be aligned with either the SPF domain or the DKIM domain.

Shopify will also rewrite an unauthenticated branded From address to store+123@shopifyemail.com (the number is per store). Customers then see a different sender than the one on your shop. Setting up DMARC on Shopify is the path back to the branded domain.

Gmail and Yahoo rules from 2024

Google’s email sender guidelines, for personal Gmail accounts, have been in force since 1 February 2024.

Every sender: SPF or DKIM; valid forward and reverse DNS (the sending IP’s PTR name must resolve back to that IP); TLS; RFC 5322 formatting; a spam rate in Postmaster Tools below 0.3%. One From header, with a single address.

More than 5,000 messages a day to Gmail: SPF and DKIM, plus DMARC. The enforcement policy may be none. The From domain must align with SPF or DKIM. Marketing messages and subscribed messages must support one-click unsubscribe and include a clearly visible unsubscribe link in the body. Google’s one-click headers are List-Unsubscribe-Post: List-Unsubscribe=One-Click and a List-Unsubscribe header. A preference page can sit beside that. Google says it should not replace one-click. In the Postmaster Tools spam-rate section, Google also says to keep the reported rate below 0.10% and to avoid ever reaching 0.30% or higher. The requirement line itself is the 0.3% / 0.30% cap.

Yahoo’s Sender Hub, enforcement beginning February 2024, asks every sender for SPF or DKIM, a spam complaint rate below 0.3%, valid forward and reverse DNS, and compliance with RFC 5321 and RFC 5322. Yahoo defines a bulk sender as significant volume and does not publish a numeric cutoff, so Google’s 5,000 figure is not Yahoo’s figure.

Yahoo bulk mail: both SPF and DKIM; a DMARC policy of at least p=none that passes; relaxed alignment is acceptable; the From domain aligned with the SPF domain or the DKIM domain; an rua tag is strongly recommended. Marketing and subscribed messages need a functioning list-unsubscribe header that supports one-click unsubscribe. Yahoo strongly recommends the RFC 8058 Post method, accepts mailto, wants a visible unsubscribe link in the body, and expects requests to be honored within two days. A link in the body alone does not meet Yahoo’s one-click requirement. Yahoo’s FAQ says one-click unsubscribe is for promotional and marketing messages, and does not apply to transactional mail such as order confirmations and password resets. List-unsubscribe enforcement began in June 2024.

Yahoo calculates that spam rate on mail it delivered to the inbox. Keep that in mind if you are comparing a complaint number from somewhere else.

Content and reputation still move the folder

Google’s guidelines spend as much space on sending practice as on DNS. Messages from people who did not ask for them get marked as spam, and later messages follow. Purchased lists, pre-checked opt-in boxes, hidden HTML, misleading subjects, and display names that pretend to be a reply are called out specifically. A shared IP inherits the reputation of everyone else on it. Spam reports, over time, lower the domain’s reputation. Google says authenticated messages are less likely to be rejected or marked as spam. “Less likely” is the claim. It is not a guarantee.

Yahoo’s FAQ describes reputation as a mix of IP, domain, URL, sender, and DKIM, and says users marking mail as spam affects it even when the sending history looked fine. Yahoo also says it usually does not file mail as spam for poor reputation alone; obfuscated URLs, a sending IP with no proper reverse DNS, and mail that is not RFC-compliant are examples of what gets combined with reputation. Yahoo does not offer a whitelist, and says a review of your sending still does not guarantee the inbox. A recipient’s own block rules can file the message regardless.

That is why a clean set of TXT records can still land in spam, and why a broken set is still worth fixing. The records are necessary for the authentication half. They do not measure which folder the next campaign will reach.