You sent an important quote on Monday and heard nothing all week. When you called the client, they said nothing had arrived, then found it after some digging in their spam folder. This happens a lot. The content is usually fine; the cause is missing settings on the company's domain.
If you know where to look, the fix takes about an hour.
Why do Gmail and Outlook mark your emails as spam?
Technically, anyone can send a message that carries your domain name, and scammers do it every day. So receiving servers ask three questions about every message. Is the server that sent it allowed to send for this domain? Is the message digitally signed, and did it arrive unchanged? And what does the domain owner want done if those checks fail?
Three records answer those questions: SPF, DKIM and DMARC. Since 2024, Google and Yahoo have tightened their requirements for senders, especially those sending large volumes every day, so in practice these records are now a condition for getting your mail delivered.
- SPFIs the sending server allowed to send in your name?
- DKIMIs the message signed by your domain and unaltered?
- DMARCWhat happens if the checks fail, and who gets the reports?
- InboxA message that passes all three lands where it should
How do you write a correct SPF record?
SPF is a TXT record in your domain settings that lists the servers allowed to send mail for you. For a domain that sends from its hosting server and from Google Workspace, it looks like this:
v=spf1 a mx include:_spf.google.com ~all
We see three mistakes over and over. The first is having two SPF records on the same domain, which makes the check fail outright, so merge them into one. The second is forgetting a service that sends on your behalf, such as your invoicing system or newsletter tool. The third is piling up include entries, because a record is limited to ten DNS lookups.
How do you turn on DKIM in cPanel?
Open cPanel and go to Email Deliverability. Next to each domain you will see its DKIM and SPF status. If the domain's DNS is managed by the same hosting account, clicking Repair is enough. If your DNS lives somewhere else, copy the record the panel shows you and add it there. If you use Google Workspace or Microsoft 365, enable DKIM from their admin console and copy the record to your domain the same way.
Which DMARC record should you start with?
DMARC is a TXT record named _dmarc. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
You will get daily reports showing who is sending mail under your domain. After a few weeks, once you are sure every legitimate sender passes, raise the policy to p=quarantine and then to p=reject. That step also protects your customers from scam emails that impersonate your company.
Can someone send email pretending to be my company?
Yes, if you have no DMARC policy in force. Email is an old protocol that does not verify the sender by itself, so any server can put your address in the From field. Some companies find out when a customer calls about an invoice they never sent, or about a request to transfer money to a new bank account.
Once your policy reaches quarantine or reject, Gmail, Outlook and other providers will reject those messages or send them to spam. DMARC protects your exact domain name, though. It cannot stop a scammer from registering a lookalike domain one letter off. That is why we suggest telling customers that payment details are never changed by email alone. And if someone steals the password to a real mailbox, their messages will pass every check. Account protection is what prevents that, as we explain in securing your hosting panel and email accounts.
What do Gmail and Outlook require from bulk senders?
Since 2024, Google has required anyone sending large volumes to Gmail, meaning a few thousand messages a day, to have SPF, DKIM and DMARC in place, include a one-click unsubscribe link in marketing emails, and keep complaint rates low. Microsoft applied similar rules in 2025 to senders who mail Outlook.com and Hotmail addresses.
These rules change from time to time, so check the sender guidelines from Google and Microsoft if you send newsletters or notifications in large numbers. A company that sends a few dozen emails a day from staff mailboxes only needs the three records set up correctly.
Records are set and the problem is still there?
Check the reputation of the IP address you send from. On shared hosting, an abusive neighbor sending from the same server can damage both your reputations. Also check the PTR record (reverse DNS): the server's address should point back to a proper hostname. Then look at the content. A message that is one big image, full of shortened links, or carrying an executable attachment will raise suspicion even with perfect records.
If you send newsletters to hundreds of addresses from ordinary staff mailboxes, move them to a proper newsletter tool. Bulk sending from a personal mailbox hurts the reputation of the whole domain.
How can you tell if your mail server is on a blacklist?
Run the IP address your mail is sent from through a blacklist checker such as MXToolbox, which tests it against dozens of lists at once. You can find the address in the original source of a received message, in the first Received lines.
If the address shows up on a list, the cause is usually a compromised account sending spam, or a website on the same server with a form that attackers are abusing. Stop the source first, then request removal through the list's own page. If you ask for delisting before the source is stopped, you will be back on the list within days. On shared hosting, ask your provider to deal with it, since the address is not yours alone.
How do you confirm the setup is correct?
Send a message to a Gmail account, open it, and choose "Show original" from the menu. You will see a line each for SPF, DKIM and DMARC, and all three should say PASS. After that, review your DMARC reports weekly for a month, or use a tool that reads and summarizes them for you.
We set up these records for every client as part of our hosting and email service. If your company's emails are landing in spam, send us your domain name and we will check it for you.
Questions our partners ask
Is SPF enough on its own?
No. SPF checks which server sent the message, and it can fail when mail is forwarded. DKIM signs the message itself, and DMARC ties both to your domain name and says what happens when a check fails. You need all three.
Should I start with a strict DMARC policy?
Start with p=none so you only monitor. Read the reports for a few weeks until you are sure every service sending in your name is configured, then move step by step to quarantine and then reject.
Why do my emails reach Gmail but not Outlook?
Each provider has its own standards, and Outlook is sensitive to the reputation of the sending IP address. If all three records are correct, ask your hosting provider about the mail server's reputation, or move your email to a dedicated email service.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
