Fix Email Landing in Spam: SPF, DKIM and DMARC Done Right

Why mail gets filtered

Receiving providers judge three things: is the sender authorised to use this domain, has the message been tampered with, and does this domain have a reputation for sending mail people want. SPF, DKIM and DMARC answer the first two. Content, list hygiene and complaint rates answer the third.

A domain with no authentication records is treated with suspicion by default, and since 2024 the largest mailbox providers actively reject or bulk-folder unauthenticated bulk mail.

Configure all three records

  • 1 SPF — publish a single TXT record on the root domain listing every system allowed to send: your hosting server, your marketing platform, your CRM and any invoicing tool.
  • 2 DKIM — enable DKIM signing in cPanel's Email Deliverability tool, then publish the generated public key TXT record. Add separate keys for third-party senders using their own selectors.
  • 3 DMARC — publish a policy record telling receivers what to do with failures and where to send reports. Start at p=none, read the reports for two weeks, then tighten.

Record examples

; SPF — one record only, keep lookups under 10
@       TXT  "v=spf1 +a +mx include:_spf.google.com include:sendgrid.net ~all"

; DMARC — start permissive, then tighten
_dmarc  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; pct=100"

; After two weeks of clean reports
_dmarc  TXT  "v=DMARC1; p=quarantine; sp=quarantine; adkim=s; aspf=s; rua=mailto:[email protected]"

Test and verify

  • Use cPanel's Email Deliverability page — it flags missing or invalid SPF, DKIM and PTR records for each domain.
  • Send a message to a mail-testing service and confirm SPF, DKIM and DMARC all pass with alignment.
  • Check your sending IP and domain against major blocklists.
  • Confirm reverse DNS (PTR) for VPS and dedicated servers matches the sending hostname — a missing PTR alone can bulk-folder everything.

Content and behaviour still count

  • Never send bulk marketing from your transactional domain; use a subdomain such as news.yourdomain.com.
  • Send only to people who opted in, and honour unsubscribes immediately.
  • Avoid link shorteners, single-image emails and attachment-heavy blasts.
  • Warm up new sending domains gradually rather than launching with 50,000 recipients.
  • Keep contact forms authenticated through SMTP rather than the PHP mail() function.

Frequently asked questions

Should SPF end with ~all or -all?

Start with ~all (softfail) while you confirm every legitimate sender is listed, then move to -all once DMARC reports show no false failures.

Do I need DKIM if I already have SPF?

Yes. SPF breaks when mail is forwarded, and DMARC requires at least one aligned mechanism — DKIM survives forwarding, so both together is the only reliable configuration.

Need a hand applying this?

Our engineers can do it for you. Open a ticket and we will help.

See plansTalk to us