Why Are Your Emails Going to Spam? The SPF, DKIM and DMARC Fix Guide for 2026

You wrote a good email, sent it to people who actually signed up, and it still landed in the spam folder. If that sounds familiar, you’re in the right place. Since the Gmail and Yahoo sender requirements rolled out in February 2024 — and enforcement tightened further through 2025 and 2026 — the single most common reason legitimate email goes to spam is missing or broken email authentication: SPF, DKIM and DMARC.

This guide is for small business owners, newsletter creators and marketers who send email from their own domain (or want to start). You don’t need to be a sysadmin. By the end you’ll know what each of the three DNS records does, how to check whether yours are set up correctly, and how to fix them step by step — either manually or by letting a modern email platform handle most of it for you.

One honest note up front: authentication gets you considered for the inbox; it doesn’t guarantee it. Content, list hygiene and complaint rates still matter, and we cover those too.

Table of contents

• Why this got stricter in 2025–2026
• Step 1: Diagnose — confirm authentication is the problem
• Step 2: Fix SPF
• Step 3: Fix DKIM
• Step 4: Add a DMARC record
• Step 5: Check alignment, unsubscribe and spam rate
• The easier path: let your email platform do it
• Common mistakes and user-reported issues
• FAQ
• Conclusion
• Sources

Why this got stricter in 2025–2026

Google’s official sender guidelines now split senders into two groups [1]:

• All senders must authenticate with at least SPF or DKIM, send over a TLS connection, have valid forward and reverse DNS (PTR) records for sending IPs, and keep spam complaint rates low.
• Bulk senders — anyone sending 5,000 or more messages per day to Gmail addresses — must have SPF and DKIM and a DMARC record, must support one-click unsubscribe on marketing mail, and the From: domain must align with the SPF or DKIM domain.

Yahoo introduced matching rules, and Microsoft announced similar requirements for high-volume senders to Outlook/Hotmail addresses in 2025 [4]. The practical effect in 2026: mail that fails authentication doesn’t just score worse — it increasingly gets rejected outright rather than merely filtered.

If you send from a free @gmail.com address through a marketing platform, you have a second problem: you can’t authenticate a domain you don’t own. Google’s own guidance warns against impersonating Gmail From: headers [1], and vendors like GetResponse explicitly advise sending from an address at your own private domain [2]. Step zero, if you haven’t done it: get a domain and send from it.

Step 1: Diagnose — confirm authentication is the problem

Before changing DNS records, verify what’s actually failing.

1. Send a test email to a Gmail account you control.
2. Open the message in Gmail, click the three-dot menu, and choose Show original.
3. At the top you’ll see three verdicts: SPF, DKIM and DMARC, each marked PASS or FAIL (or missing).
4. Note which domain passed. If SPF passes for your platform’s domain (e.g. a GetResponse or ActiveCampaign sending domain) but not yours, you have an alignment problem — more on that in Step 5.
5. For ongoing monitoring, register your domain in Google Postmaster Tools (free). It shows your spam complaint rate and authentication success over time [1].

If all three say PASS and mail still lands in spam, skip to Step 5 — your issue is likely reputation, content or complaint rate rather than authentication.

Step 2: Fix SPF

SPF (Sender Policy Framework) is a DNS TXT record on your domain that lists which servers are allowed to send mail on your behalf.

1. Log in to wherever your domain’s DNS is managed (registrar or DNS host — Cloudflare, Namecheap, GoDaddy, etc.).
2. Look for an existing TXT record on the root of your domain that starts with v=spf1. You can only have one SPF record per domain — if one exists, edit it; don’t add a second.
3. Add an include: mechanism for every service that sends mail as your domain. For example, GetResponse’s SPF mechanism is include:_spf.getresponse.com [5]. Google Workspace uses include:_spf.google.com. Your record might end up looking like:

   v=spf1 include:_spf.google.com include:_spf.getresponse.com ~all

1. End the record with ~all (softfail) or -all (hardfail). Never use +all — it authorizes the entire internet.
2. Save, wait for DNS propagation (minutes to a few hours), and re-run the Step 1 test.

Watch the 10-lookup limit. SPF validation fails if resolving your record requires more than 10 DNS lookups — a common failure for businesses that have stacked up many include: entries over the years. If you’re near the limit, remove includes for services you no longer use.

Step 3: Fix DKIM

DKIM (DomainKeys Identified Mail) cryptographically signs each message; receivers verify the signature against a public key published in your DNS.

1. In your email platform, find the domain authentication section. In GetResponse it’s under Profile → Emails and Domains → Email addresses, then the Actions menu next to your domain [2]. ActiveCampaign and most competitors have an equivalent “domain authentication” or “sending domains” page.
2. The platform generates one or more DNS records — typically a TXT record (or CNAME pair) at a host like selector._domainkey.yourdomain.com.
3. Copy each record into your DNS exactly as given. The most common failure is the host name: some DNS providers auto-append your domain, so entering selector._domainkey.yourdomain.com in full creates a broken ...yourdomain.com.yourdomain.com entry. If verification fails, try entering just selector._domainkey.
4. Return to the platform and click verify.
5. Key strength: Google requires a DKIM key of at least 1024 bits and recommends 2048-bit [1]. Reputable platforms handle this for you; if you’re generating keys manually, choose 2048.

Step 4: Add a DMARC record

DMARC ties SPF and DKIM together: it tells receiving servers what to do with mail that fails, and sends you reports. Since 2024, bulk senders to Gmail must have one — though the policy can start as none [1].

1. In your DNS, create a TXT record at host _dmarc (i.e. _dmarc.yourdomain.com).
2. Start with a monitoring-only policy:

   v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

1. The rua address receives aggregate reports showing who is sending as your domain and whether they pass. Use a mailbox you actually check, or a free/paid DMARC report parser.
2. Configure DKIM before DMARC. GetResponse’s documentation notes DKIM must be properly configured before DMARC is set up [2] — otherwise your own legitimate mail can fail your policy.
3. After a few weeks of clean reports, consider tightening to p=quarantine and eventually p=reject for real spoofing protection. Don’t jump straight to reject on day one.

Step 5: Check alignment, unsubscribe and spam rate

Three requirements that trip up senders who “already set everything up”:

Requirement	What it means	Who it applies to
Alignment	The domain in your From: header must match the domain that passed SPF or DKIM [1]	Bulk senders (required), everyone (recommended)
One-click unsubscribe	Marketing mail needs List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click headers [1]	Bulk senders
Spam complaint rate	Keep the rate reported in Postmaster Tools low — avoid ever reaching 0.3% [1]	Everyone

Alignment is why sending from you@yourdomain.com while only your platform’s domain is authenticated still fails DMARC: SPF may technically pass for the platform’s bounce domain, but it doesn’t align with your From: domain. Completing Step 3 (DKIM on your domain) is what fixes alignment for most platform senders.

One-click unsubscribe and TLS are handled automatically by any reputable email marketing platform — this is genuinely a reason to send through one rather than hand-rolling SMTP.

The easier path: let your email platform do it

Everything above is doable by hand, but a modern email platform removes most of the sharp edges. GetResponse, for example, documents both a manual DNS path and an automatic option where the platform authenticates your domain for you [2], generates the DKIM records, and applies compliant unsubscribe headers to every campaign. ActiveCampaign offers equivalent guided domain authentication.

If you’re starting fresh or your current tool makes authentication painful, that’s a fair reason to switch — troubleshooting deliverability is much easier when the platform surfaces authentication status on a dashboard instead of leaving you to read raw headers.

👉 Try GetResponse and set up authenticated sending on your own domain

Common mistakes and user-reported issues

These come up repeatedly in community forums and independent deliverability write-ups — labeled here as user-reported experience, not official guidance:

• Two SPF records. Users report adding a second v=spf1 record for a new tool instead of merging includes — which makes SPF fail entirely. Merge everything into one record.
• Duplicated domain in DKIM host names. As noted in Step 3, users frequently report DKIM verification failing because their DNS provider auto-appended the domain. Check the final resolved host name with a DNS lookup tool.
• Testing too soon. DNS changes can take from minutes to 24–48 hours to propagate depending on TTL; users report “fixes that didn’t work” that simply hadn’t propagated yet.
• Warming up too fast. Users report new domains that go straight to sending thousands of emails per day getting rate-limited or filtered; Google’s guidelines advise increasing volume gradually [1].
• Assuming authentication fixes a burned list. If your complaint rate is already high from old, cold or purchased lists, SPF/DKIM/DMARC won’t rescue you. Cut unengaged contacts first.

FAQ

Do I need DMARC if I send fewer than 5,000 emails a day? It’s only required for bulk senders under Google’s guidelines [1], but a p=none DMARC record costs nothing, gives you visibility reports, and future-proofs you if your list grows. Set it up anyway.

Can I fix spam placement while sending from a @gmail.com address? Not really. You can’t publish SPF/DKIM/DMARC for a domain you don’t control, and impersonating Gmail in the From: header is specifically flagged in Google’s guidelines [1]. Buy a domain — it’s the cheapest deliverability upgrade there is.

How long until I see results after fixing SPF, DKIM and DMARC? Authentication verdicts change as soon as DNS propagates (usually within hours). Inbox placement can take longer, since mailbox providers also weigh your accumulated sending reputation over days to weeks of consistent, complaint-free sending.

Does DMARC p=none actually do anything? Yes — it satisfies the bulk-sender requirement to have a DMARC record [1] and turns on reporting so you can see failures. It just doesn’t instruct receivers to quarantine or reject failing mail yet.

My SPF, DKIM and DMARC all pass but I’m still in spam. Now what? Check Postmaster Tools for your complaint rate and domain reputation, remove unengaged subscribers, avoid link shorteners and spammy formatting, and make unsubscribing effortless. Authentication is the entry ticket, not the whole game.

Conclusion

“Why are my emails going to spam?” almost always has a boring answer in 2026: your domain isn’t fully authenticated, or it’s authenticated but not aligned. The fix is a few DNS records — one SPF record with the right includes, DKIM records from your email platform, and a _dmarc TXT record starting at p=none — plus keeping complaints low and unsubscribes easy.

If you’d rather have a platform generate the records, verify them, and keep the compliance headers on every send, GetResponse’s guided domain authentication does exactly that, and its help documentation for SPF, DKIM and DMARC is among the clearer vendor guides out there [2][3].

👉 Get started with GetResponse here