Almost every "emails going to spam" problem traces back to the same three DNS records, misconfigured, missing, or never set up in the first place.
The three records, in plain English
- SPF: a list of servers allowed to send email on your domain's behalf. Without it, inbox providers can't verify your email is legitimately from you.
- DKIM: a cryptographic signature proving the email wasn't tampered with in transit. Missing DKIM is one of the fastest ways to get flagged.
- DMARC: the policy telling inbox providers what to do when SPF or DKIM fail, reject, quarantine, or do nothing. Without a DMARC policy, providers default to trusting your domain less over time.
Why this breaks silently
Nobody notices a missing DKIM record until deliverability quietly craters over weeks, not overnight. A domain change, a new sending tool, or a DNS migration can break one of these three records without any visible error message, and the first symptom anyone notices is "open rates dropped" months later.
The other half: list hygiene
Correct DNS records won't save a list full of dead addresses and spam-trap emails. Regular list cleaning and re-permissioning matters just as much as the technical configuration, since inbox providers track engagement patterns across your whole list, not just individual sends.
The fix, in order
Check all three records exist and are correctly configured (a five-minute lookup with the right tool). Clean the list. Warm a new sending domain gradually if you're starting fresh, rather than blasting volume on day one. Get this right once, and it stops being something you think about.
See how deliverability gets configured properly before a single campaign goes out →