If mail from your domain lands in spam (or vanishes), it's almost always missing/incorrect authentication. The three records, decoded:
- SPF — a DNS TXT record listing who is allowed to send mail for your domain. One record only; list every sender (your host, plus Google/Zoho/Mailchimp if used).
- DKIM — a cryptographic signature proving the mail wasn't tampered with. Your mail provider gives you the record to paste into DNS.
- DMARC — a policy that says what to do when SPF/DKIM fail, and emails you reports. Start gentle:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com, watch the reports, then tighten to quarantine and eventually reject.
Common gotchas: two SPF records (invalid — merge them), sending from an IP not in SPF, or forgetting DKIM entirely.
Test with a tool like mail-tester or check the raw headers for spf=pass dkim=pass dmarc=pass. ✅
Stuck on a specific record? Paste it here (redact anything private) and we'll sanity-check the syntax. It's usually one typo. 🔎
