hello@kootenaymade.ca
Castlegar, BC. Serving the Kootenays and beyond.
7 min
Key takeaways
- SPF lists who may send for you, DKIM signs each message, and DMARC says what to do with fakes.
- Since February 2024, Gmail and Yahoo ask every sender for at least SPF or DKIM.
- Every app that sends mail as you, like booking or invoicing, has to be in your SPF record.
- A contact form that sends “from” the customer often fails the checks. Send it from your own domain.
- Gmail’s Show original page tells you in a minute whether your mail passes.
On this page
Why are my emails going to spam?
Often, your emails are going to spam because your domain has not proven the mail is really from you. Gmail, Yahoo and Outlook check three records on your domain, called SPF, DKIM and DMARC. Since February 2024, Gmail asks every sender for SPF or DKIM. Google says mail that fails these checks may be marked as spam.
You cannot see these records in your inbox. They live in your domain’s settings, called DNS, next to the records that point people to your website. Your email host gives you the exact values to add.
Spam filters weigh more than these three records. They also look at what you send and how people react to it. This guide starts with the records, because all three providers put them first in their rules. Then it covers the rest.
What are SPF, DKIM and DMARC?
They are three short text records on your domain, and each one has one job. SPF is a list of who may send for you. DKIM is a signature on each message. DMARC is your instruction for what to do with fakes that fail the other two.
- SPF
- A list of who may send email for your domain. Your email host goes on it, and so does every app that sends mail as you.
- DKIM
- A signature on every message. The receiving server checks it to see that the mail came from your domain and was not changed on the way.
- DMARC
- Your instruction for fakes. It tells the receiving server what to do with mail that claims to be from you and fails the other two checks.
Google and Yahoo both describe the records this way. Together they let a receiving server check that a message claiming to be from your shop really came from your shop. If you are still setting up an address at your own name, start with my guide to business email for a small business.
What do Gmail, Yahoo and Outlook require now?
Gmail and Yahoo ask every sender for SPF or DKIM, and have since February 2024. Bulk senders need all three records at Gmail, Yahoo and Outlook.com. Outlook.com began enforcing its rule for domains sending over 5,000 emails a day on May 5, 2025.
| What is being compared | Every sender | Bulk senders |
|---|---|---|
| Gmail | SPF or DKIM, since February 1, 2024 | Over 5,000 a day: SPF, DKIM and DMARC |
| Yahoo | SPF or DKIM, since February 2024 | Bulk senders: SPF, DKIM and DMARC |
| Outlook.com | Recommended for everyone | Over 5,000 a day: SPF, DKIM and DMARC, since May 5, 2025 |
| Spam complaints | Gmail and Yahoo want under 0.3% | Gmail suggests aiming under 0.1% |
If you send fewer than 5,000 emails a day, the every-sender rule is the one that applies to you. A newsletter list puts you closer to the bulk rules, which also ask for a one-click unsubscribe. The Canadian consent rules for that list are in my guide to CASL and email marketing.
What else sends good email to spam?
Five other causes come up often. A website contact form that sends as the customer, an app missing from your SPF record, a brand new domain, risky links or attachments, and people clicking “report spam”. Each one has a simple fix.
- 01
A contact form that sends “from” the customer
Many website forms email you using the customer’s own address as the sender. Your web server is not on the list for gmail.com, so the message fails the checks. Google tells senders not to fake Gmail addresses. The fix is to send form mail from your own domain and put the customer’s address in the reply-to.
- 02
An app you forgot about
Your booking system, invoicing app and newsletter tool all send mail as you. Google says senders missing from your SPF record are more likely to land in spam. Microsoft says the records still belong on your domain when another company sends for you.
- 03
A new domain
A brand new domain has no sending history yet. Google advises starting with a small amount of mail to people who expect it, then growing slowly. A sudden jump, like a first newsletter to everyone you know, can slow your delivery.
- 04
Links and attachments
Gmail blocks some attachment types, like .exe files, and messages with links that may carry viruses. Google asks that links be easy to read so people know where they go. Send large files as a link to a shared folder.
- 05
People marking you as spam
Every “report spam” click counts against you. Send only to people who asked to hear from you, and never buy a list. Google says a high spam rate takes time to recover from.
If an app sends mail as you, it has to be on your list.
How do I check whether my emails pass?
Send yourself a test and read its header. In Gmail, open the message, click More, then Show original. Look for SPF, DKIM and DMARC, each marked PASS. Google’s free Messageheader tool reads the whole header for you. It takes about ten minutes.
- 01Send an email from your business address to a personal Gmail account.
- 02Open it in Gmail on a computer. Next to Reply, click More, then Show original.
- 03Look for three lines near the top, one each for SPF, DKIM and DMARC. Each should say PASS.
- 04For a fuller reading, copy the header and paste it into the Messageheader tool in Google’s free Admin Toolbox.
- 05If one fails, open the email settings page at your email host. It lists the exact records to add to your domain.
- 06Add the records where your domain’s DNS lives, then send another test the next day.
Change one record at a time and test again after each change. DMARC can start at p=none, which only watches. Microsoft advises moving to quarantine and then reject in steps, once every tool that sends as you passes. If a form on your site is the problem, my guide to a contact page that feels like a dead end covers the rest of what a good form should do.
Sources and further reading
- Email sender guidelines, Gmail Help
Read October 23, 2026. From February 1, 2024, every sender to Gmail needs SPF or DKIM, and senders of more than 5,000 a day need SPF, DKIM and DMARC. Also covers spam rates, sending volume, links and impersonating Gmail addresses.
- Sender best practices, Yahoo
Read October 23, 2026. From February 2024, all senders need SPF or DKIM and a spam rate under 0.3%. Bulk senders need SPF, DKIM and a DMARC policy.
- Outlook’s new requirements for high-volume senders, Microsoft
Posted April 2, 2025, updated April 30, 2025, read October 23, 2026. Domains sending over 5,000 a day to Outlook.com need SPF, DKIM and DMARC from May 5, 2025.
- Trace an email with its full header, Gmail Help
Read October 23, 2026. How to open Show original and copy the full header.
- Troubleshoot DMARC issues, Google Workspace Help
Read October 23, 2026. Headers carry the SPF, DKIM and DMARC results, and Google points to its Admin Toolbox Messageheader tool to read them.
- File types blocked in Gmail, Gmail Help
Read October 23, 2026. Lists the attachment types Gmail blocks and notes that some links can get a message blocked.
Frequently asked questions
Do I need DMARC if I only send a few emails a day?
The hard rule from Gmail, Yahoo and Outlook.com is for bulk senders. Google still recommends SPF, DKIM and DMARC for every domain, and Microsoft says all senders benefit. A DMARC record can start at p=none, which only watches, so it is a small step.
Why do my emails go to spam at Outlook but not Gmail?
Each provider runs its own filters and keeps its own record of mail from your domain. A message can pass at one and fail at another. Send a test to an account at each, read the headers, and fix whichever check fails.
Why do my website contact form emails go to spam?
Most often the form sends the message “from” the customer’s address, using a server that is not allowed to send for that address. Set the form to send from your own domain, with the customer’s address as the reply-to. Then make sure your domain’s SPF and DKIM cover the server that sends it.
Should I set DMARC to reject straight away?
No. Microsoft advises moving in steps, from none to quarantine to reject, so you do not lose real mail. Start at none, read the reports for a few weeks, and tighten it once every tool that sends as you passes.
Can I have two SPF records?
Keep one SPF record per domain and add each sender to it. Microsoft notes that an SPF record needing more than 10 DNS lookups can fail the check, so remove tools you no longer use.
Related pages
Kootenay Made Digital
I build websites, local presence, and calm AI setups for Kootenay small businesses. Prices are published, and the work is built to make you easier to find and easier to choose.
