Why emails go to spam: SPF, DKIM, and DMARC in plain English

Lukas Vincevičius, Founder of MailyScaly · Updated 2026-06-03 · ~9 min read

You can write the best email in the world — if it lands in spam, its value is exactly zero. Deliverability is the invisible foundation of email marketing: while it works, nobody thinks about it, and when it breaks, every campaign and every automation crashes at once. In this guide: how spam filters really work, and what those three cryptic acronyms Gmail demands actually mean.

How spam filters really work

The popular myth: "my email went to spam because I wrote FREE in all caps". The reality: modern filters (Gmail, Outlook, Yahoo) make their decision mostly based on the sender, not the content. In simplified order of importance:

1. Authentication — is it technically proven that the email really comes from your domain (SPF, DKIM, DMARC)? Without this, these days you don't even get off the starting line.
2. Sender reputation — your domain's and sending IP's "credit history": how many complaints, how many nonexistent addresses, whether volumes are stable.
3. Recipient behavior — do people open, read, and reply to your emails? Or delete them unread and mark them as spam? Gmail sees this and learns.
4. Content — yes, it gets evaluated too, but it usually becomes decisive only once the first three points are already limping.

That's why avoiding "spam words" while your domain reputation is poor is tilting at windmills — you need to fix the foundations.

SPF, DKIM, DMARC — three gatekeepers, in plain English

SPF — the guest list

What it does: publicly declares, in your domain's DNS record, which servers are allowed to send email on your behalf. The receiving server checks: "this email came from server X — is X on mailyscaly.com's guest list?" If not — suspicion.

What it looks like (a DNS TXT record):

v=spf1 include:_spf.google.com include:spf.omnisend.com ~all

Translation: "Google (your work email) and Omnisend (your marketing platform) may send on our behalf; don't trust anyone else". Every platform that sends on your behalf must be added here via include:.

DKIM — the signature and seal

What it does: signs every email with a cryptographic signature, which the recipient verifies against the public key published in your domain's DNS. This proves two things: the email is genuinely yours, and nobody altered it in transit. The analogy — a notary's seal on a document.

How to set it up: in your email platform (Omnisend: Store settings → Sender domains) you add your domain, the platform gives you a few DNS records (usually CNAME), you add them at your domain registrar — and the platform starts signing emails with your domain instead of a generic "via omnisend.com". This is the single most important setting in all of deliverability.

DMARC — the rules and the reports

What it does: tells receiving servers what to do with emails that impersonate your domain but fail the SPF/DKIM checks — and sends you reports about everyone attempting to send in your name.

v=DMARC1; p=none; rua=mailto:dmarc@mailyscaly.com

Gmail and Yahoo requirements: no longer a recommendation

Since February 2024, Gmail and Yahoo have enforced mandatory requirements for bulk senders (5,000+ emails per day to Gmail; Outlook later introduced similar rules), and for smaller senders they have become the de facto standard:

• SPF and DKIM — mandatory for all senders;
• DMARC — mandatory for bulk senders (at least p=none);
• One-click unsubscribe — mandatory for marketing emails; serious platforms handle this automatically;
• Spam complaint rate below 0.3% — and better kept below 0.1%; track it via Google Postmaster Tools.

The practical consequence: unauthenticated sending in 2026 no longer means "somewhat worse deliverability" — it means emails that simply never reach Gmail users. And for most consumer audiences, Gmail dominates.

Check yourself in 5 minutes

1. mail-tester.com — send your campaign email to the address it gives you and get a score with specific issues flagged (SPF? DKIM? blacklists?). Free, no registration.
2. Gmail "Show original" — open your own email in Gmail → three dots → "Show original". At the top you should see SPF: PASS, DKIM: PASS, DMARC: PASS. Even one FAIL — you've found your problem.
3. MXToolbox (mxtoolbox.com) — checks your domain's SPF/DMARC records and whether your IP is on any blacklists.
4. Google Postmaster Tools — shows how Gmail rates your domain's reputation and your complaint rate. A must-have for anyone who sends regularly.

Authentication is fixed, but emails still land in spam?

Then the problem is reputation and behavior. The most common causes, based on our client work:

• You send to everyone, every time. Half your list hasn't opened an email in a year; Gmail sees that and applies the conclusion to all your emails. The fix — send more often to engaged subscribers, and rarely or never to the "dead" ones (a sunset policy).
• A bought or "borrowed" list. Spam traps and complaints wreck your reputation within a few campaigns. It never pays off.
• Sudden volume spikes. Silent for 3 months, then 50,000 emails in a day? To the filters, that looks like a hijacked domain. Grow volume gradually (warm-up).
• No easy way to unsubscribe. If opting out is hard, people hit "Spam" instead — and that hurts ten times more than an unsubscribe.
• Old damage. If your domain reputation is already wrecked, there's no shortcut: clean the list, send only to your most engaged recipients, and reputation recovers within 1–3 months. In severe cases it's cheaper to start over on a new sending subdomain.

Frequently asked questions