Why Your Custom Domain Emails Go to Spam (and the 15-Minute Fix)

Anyone can put any address in an email’s From line — the protocol doesn’t check. So mailbox providers ask your domain’s DNS three questions instead: who is allowed to send for this domain (SPF), can I verify this exact message wasn’t altered and really came from them (DKIM), and what should I do when a message fails those checks (DMARC). A domain that answers none of them looks exactly like a domain a spammer registered yesterday. Since 2024, Gmail and Yahoo have required bulk senders to have all three — and in practice, missing records hurt small senders too.

SPF is a single TXT record on your domain listing the servers permitted to send as you. If you send through Google, it looks like this:

v=spf1 include:_spf.google.com ~all

Every service that sends for you gets an include in the same record — one record, several includes. The classic mistake is creating a second SPF record for a second service: two SPF records is invalid and receivers may treat it as no SPF at all. The ~all at the end means “treat anything else with suspicion.”

DKIM has your sending service cryptographically sign each message; the public key lives in your DNS so receivers can verify it. You don’t invent this record — your provider generates it and tells you what to publish, typically a TXT (or CNAME) at a name like:

google._domainkey.yourdomain.com → v=DKIM1; k=rsa; p=MIIBIjANBg…

Find the DKIM section in your provider’s settings, copy the record, paste it into DNS, and press verify. This is the single highest-impact record of the three: an aligned DKIM signature is the strongest “this is really us” signal Gmail sees.

DMARC tells receivers what to do with mail that fails SPF and DKIM, and — crucially — its mere presence signals a legitimately run domain. Start with the gentle version:

_dmarc.yourdomain.com → v=DMARC1; p=none; rua=mailto:you@yourdomain.com

p=none means “don’t reject anything yet, just send me reports.” Once the reports show only legitimate mail flowing, tighten to p=quarantine and eventually p=reject. Publishing p=none takes one minute and already improves how you’re scored.

One: add the SPF record with an include for each sending service (and delete any duplicate SPF). Two: enable DKIM in your provider and publish its key. Three: publish a p=none DMARC record. Four: send a test to a Gmail address, open the message, choose “Show original,” and confirm SPF, DKIM, and DMARC all say PASS. Five: give DNS up to an hour. Beyond the records, spam scoring also weighs content — a plain, personal first email from a new domain fares better than an image-heavy blast — but the records are the part you can fix today.

Fair warning of bias: this is part of why we built All Your Inboxes. Incoming mail to your domain addresses lands as notifications in the Gmail you already check, replies go out from your own domain, and on the Pro plan SPF and DMARC issues on your domain are detected and fixed automatically — the record-wrangling above becomes our job (how we handle your mail is on the security page). Plans start free for one inbox — details on pricing. And if you’re consolidating several domains into one inbox anyway, our four-way comparison covers the DIY routes honestly too.