Fixing Email Deliverability: SPF, DKIM, DMARC, and Why Mail Goes to Spam
If your emails are landing in spam folders or getting rejected outright, the cause is almost always missing or misconfigured DNS authentication records. Mail providers like Gmail, Outlook, and Yahoo check three record...
0 views
If your emails are landing in spam folders or getting rejected outright, the cause is almost always missing or misconfigured DNS authentication records. Mail providers like Gmail, Outlook, and Yahoo check three records – SPF, DKIM, and DMARC – to decide whether a message from your domain is trustworthy. This guide explains what each one does and how to fix the most common deliverability problems.
SPF (Sender Policy Framework)
SPF is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Without it, receiving servers have no way to confirm your mail is legitimate, and much of it may be marked as spam or rejected.
A typical SPF record for a domain hosted with GrabbyHost looks like:
v=spf1 a mx include:_spf.grabbyhost.com ~all
If you use a third-party sender too (like a marketing platform or a helpdesk), add its own include: value to the same record – a domain can only have one SPF record, so combine every sending source into it rather than creating a second one.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to outgoing messages, which lets receiving servers verify the email wasn't altered in transit and really came from your mail server. It's published as a TXT record containing a public key, usually at a hostname like default._domainkey.yourdomain.com.
For mailboxes hosted with GrabbyHost, the DKIM record is generated automatically when you create an email account. You can find the exact record to publish under your hosting control panel's Email Deliverability or DKIM Manager tool – copy the record it provides and add it as a TXT record in your DNS.
DMARC (Domain-based Message Authentication)
DMARC tells receiving mail servers what to do when a message fails SPF or DKIM checks, and gives you visibility into who's sending mail using your domain (including potential spoofing attempts). It's a TXT record published at _dmarc.yourdomain.com, for example:
v=DMARC1; p=quarantine; rua=mailto:postmaster@yourdomain.com; pct=100
Start with p=quarantine or even p=none (monitor-only) while you confirm all your legitimate mail sources pass SPF/DKIM, then move to p=reject once you're confident nothing legitimate will be blocked.
Adding These Records
- Log in to the client area and open Domains > My Domains, then manage DNS for the domain (see How to Update DNS Records if your domain uses GrabbyHost nameservers).
- Add the SPF, DKIM, and DMARC values above as TXT records at the hostnames shown.
- DNS changes can take anywhere from a few minutes up to 24–48 hours to fully propagate.
Other Common Causes of Spam Placement
- Mismatched "From" domain – sending "from" a domain that doesn't match your SPF/DKIM setup will fail authentication even if the records are correct.
- Poor sender reputation – a domain or IP with a history of spam complaints will be filtered regardless of correct DNS records; this improves over time with clean sending habits.
- Missing reverse DNS (PTR) – if you're sending from a dedicated IP or VPS, make sure a PTR record resolves back to your mail server's hostname.
- Spammy content or formatting – excessive links, spam-trigger words, or an unbalanced text-to-image ratio can hurt placement even with perfect authentication.
Related Articles
- How to Update DNS Records (A, CNAME, MX, TXT)
- How to Create an Email Account
- How to Set Up Email Forwarding and Autoresponders
Was this answer helpful?Your response helps us improve future guides.