Answers · 13 November 2026 · By Dorian, founder

Our emails land in spam. Why, and how do we fix it?

Most often, your domain does not prove that your emails are really yours. Three records on the domain do that: SPF, DKIM and DMARC. Gmail, Yahoo and Outlook.com check them on every message, and the same three records stop other people sending email as you.

1. See what the receiving server saw

Send an email from your business address to a Gmail address. Open it there, choose "Show original" from the three-dot menu, and read the lines SPF, DKIM and DMARC: each should say PASS. A line that says FAIL, or is missing, is the one to fix.
mail-tester.com gives you an address to send a message to, then marks the message out of ten and names what is wrong.
Our free Health check reads the three records on your domain and reports them on one page.

2. The three records, in plain words

SPF is the list of servers allowed to send email for your domain. A domain has one SPF record, and every service that sends as you has to be in it.
DKIM is a signature the sending service adds to every message. The receiving server checks it against a key published on your domain, so it knows the message is yours and was not changed on the way.
DMARC ties the two checks to the address your reader sees. It tells the receiving server what to do with a message that fails them: deliver it anyway, put it in spam, or refuse it. It also asks for reports on who is sending email as your domain.

All three are text records in your domain's DNS, the place that points your name at your website. Whoever manages the domain can add them.

3. Fix them in this order

List everything that sends email as your domain: the mailboxes, the website's contact form, the newsletter tool, the invoicing, booking or till system, a scanner that emails documents.
Put every one of them into the one SPF record. Two SPF records on one domain make the check fail.
Switch on DKIM in each of those services. Each gives you a record to publish.
Add a DMARC record that only watches at first, and name an address for the reports: v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.co.uk
Read the reports for a few weeks. When everything you send passes, change p=none to p=quarantine, and later to p=reject.

Do not start at p=reject: email from a service you forgot, the invoicing system for example, would be refused. The reports are files made for software; a DMARC report reader turns them into a list a person can read.

4. If all three pass and email still lands in spam

A new domain or a new address has no history yet. Write to people who expect your email, and raise the numbers gradually.
Newsletters from your everyday address. Send bulk email through a newsletter service, with an unsubscribe link in every message, and only to people who asked for it.
A mailbox that was broken into and used to send spam drags the whole domain down. Change its password, switch on two-step login and remove forwarding rules nobody remembers making.
The sending server is on a blocklist. On shared hosting you share a sending address with strangers. The bounce message usually names the list. Your provider has to ask for the server to be taken off it, or you move your email.
The message itself. One large picture with no text, a shortened link, or an attachment that filters distrust, such as a zip file or a document with macros.
Only one recipient? Ask them to mark your message as not spam and add you to their contacts, or ask their IT to allow your domain.

5. If someone is sending emails as you

Forged email that uses your exact domain is what DMARC stops: at p=reject, servers that check it refuse the forgery, and the reports show who tried. It does not stop a lookalike domain, with one letter changed or a different ending, or a stranger's address with your name in front of it. Tell your clients how you confirm a change of bank details: by phone, on a number they already have.

How DARCH helps

Email with DARCH runs on our own mail server, with spam filtering and encrypted connections. SPF, DKIM and DMARC are set up for every domain, so receiving servers can tell your real mail from mail forged in your name. If your email stays with another provider, the Security check puts the three records right there.

Service	What you get	Price
Health check	A one-page report from public information only: website speed and certificate, email protection, and when your domain expires. Nothing on your systems is scanned or tested.	Free
Security check	Accounts, two-step logins, backups, email protection and the leavers process checked and fixed, with a short written summary.	£250
Business email	An address on your own name (you@yourbusiness.co.uk) with spam filtering, setup on phones and computers, protection against others sending mail as you, and nightly backups. No adverts, no tracking. Office essentials and Office plus already include mailboxes. This price is for extra ones, or with Website maintenance.	£4 per mailbox a month

Every service and price