Email · 11 min read · Updated: 2026-10-26

Are your emails going to spam? Fixing SPF, DKIM and DMARC records

However professional the address on your own domain looks, if the recipient's server doesn't trust it, the message stays in the spam folder. The key to that trust is three DNS records.

In short

• An SPF record is a TXT record listing which servers may send email on behalf of your domain; a domain can have only one SPF record.
• DKIM adds an encrypted signature to every email sent; the recipient verifies it with the public key in your domain's DNS and knows the message wasn't altered on the way.
• A DMARC record says what to do with emails that fail SPF and DKIM or don't match the sender address; p=none only monitors, p=quarantine sends to spam, p=reject refuses.
• Gmail requires all three of SPF, DKIM and DMARC from senders of more than 5,000 emails a day; smaller senders need at least SPF or DKIM.
• In the Heyşirket company panel, the email setup screen checks these records line by line; if the domain is on Heyşirket's infrastructure it adds missing records itself, and starts DMARC at p=none if there's none.

You sent the quote and the customer says "nothing arrived". Notifications from your website's contact form land in your own spam folder. The common cause of both complaints is usually not the content but your domain's DNS settings. Most people searching for emails going to spam have left one of the SPF, DKIM or DMARC records missing or wrong.

In this article we explain what the three records do, how to read them and the most common mistakes. We covered setting up a business email address from scratch in how to set up business email; here the topic is getting the emails from an existing address delivered.

Part 1 · Cause Why do emails go to spam?

The recipient's mail server asks every incoming message the same question: does this email really come from the owner of the sender address? A message without authentication can't be told apart from a forged one. That's why large email providers put unverifiable messages in spam or don't accept them at all.

Other things affect the spam decision too: a new domain, sending many emails in a short time, complaint rates, shortened links and suspicious attachments. But if the DNS records are missing, fixing the rest isn't enough. This is the first place to look.

Part 2 · SPF What is an SPF record and how do you read it?

SPF (Sender Policy Framework) is a TXT record listing the servers authorised to send email on behalf of your domain. The receiving server checks whether the server delivering the message is on that list.

v=spf1 include:_spf.example-provider.com ~all

• v=spf1: says this is an SPF record. Every SPF record starts with it.
• include: includes another service's list of authorised servers, for example your email provider's.
• ~all: mark email from anything not on the list as "suspicious". -all means reject outright; don't use it until you're sure of all your sending sources.

Part 3 · DKIM What is DKIM and what does it do?

DKIM (DomainKeys Identified Mail) adds an encrypted signature to every email sent. The sending server signs the message with a private key. The recipient verifies the signature with the public key in your domain's DNS.

A DKIM record sits in your domain under a name like selector._domainkey. The selector is a short name the provider gives you, so different services can have separate DKIM keys on the same domain. Unlike SPF, the signature stays intact even if the email is forwarded through another server.

Part 4 · DMARC What is DMARC, and which policy should you start with?

DMARC combines the SPF and DKIM results with the sender address and says what to do with emails that fail. It sits in your domain as a TXT record named _dmarc.

v=DMARC1; p=none;

DMARC's key idea is alignment. Passing isn't enough; the domain that passed must belong to the same organisational domain as the address in the email's From line. For example, an email sent from quotes@yoursite.com must be signed for yoursite.com or one of its subdomains.

If you add rua=mailto:... to the record, large providers send you aggregate reports showing who sends email on behalf of your domain. Looking at these for a few weeks before tightening the policy helps you spot a sending source you forgot, such as an invoicing or newsletter service.

Part 5 · Rules What do Gmail and the big providers require?

Google publishes written rules for anyone sending email to Gmail addresses. Everyone needs at least SPF or DKIM. Senders of more than 5,000 emails a day are expected to have all three of SPF, DKIM and DMARC, alignment with the From address, one-click unsubscribe and a low spam complaint rate.

A small business rarely reaches 5,000 emails a day. Still, setting up all three records together raises your delivery rate and makes it harder for anyone to send fake email in your domain's name. A forged invoice or IBAN-change email reaching your customers is a much more expensive problem than the spam folder.

Part 6 · Checks How do you check SPF, DKIM and DMARC records?

A five-minute check

1. Send yourself a test email

   Send an email from your business address to a Gmail address. Open it in Gmail and choose show original from the menu; the SPF, DKIM and DMARC lines should say PASS.

2. Count your SPF records

   In your domain's DNS panel, see how many records start with "v=spf1". If there's more than one, merge them.

3. Check the DKIM record name

   The record name must match the selector the provider gave you. If the domain was appended twice (e.g. selector._domainkey.yoursite.com.yoursite.com), fix it.

4. Confirm a DMARC record exists

   There should be a TXT record named _dmarc starting with "v=DMARC1". If not, start with p=none.

5. Wait for propagation

   DNS changes usually spread within a few minutes to a few hours. If you don't see a result straight away, wait and try again rather than deleting and re-adding the record.

Part 7 · Heyşirket How are these records set up in the Heyşirket company panel?

In Heyşirket, a mailbox on your own domain is included even in the free Başlangıç package. The setup screen in the E-posta (Email) section of the company panel moves in three steps: method, records and ready. In the method step you see these paths depending on your domain: Otomatik kurulum (automatic setup) if your domain is on Heyşirket's infrastructure, otherwise E-postayı bize yönlendirin (point email to us); in both cases Mevcut e-postanızı koruyun (keep your existing email).

If your domain already has a working email service, the screen says so and recommends setting up without touching it. No DNS record is deleted and your working MX record isn't changed.

Each line shows a live status: verified, visible in DNS and being verified by the provider, record added and propagating, or this record needs to be added to your DNS panel. If your domain is on Heyşirket's infrastructure, the panel adds missing records itself. If not, the screen lists the records you need to add with their names and values and re-checks automatically; if you don't want to wait there's a Şimdi denetle (check now) button.

If you have no DMARC record, the panel starts one with v=DMARC1; p=none;, so it blocks nothing and only monitors. It doesn't touch an existing DMARC record. The sending records living on a subdomain is an important detail too: if you use another email service on your domain, you won't fall into the trap of creating two separate SPF records for two services.

If you haven't connected your domain to the company panel yet, first follow connecting your own domain; there's a summary on the connect a domain page. Mailbox and address limits by package are on the business email page. If you get stuck on the DNS side, there's a step-by-step guide in the panel: Help › Domain troubleshooting.

Check your email records Open the setup screen to see SPF, DKIM and DMARC status line by line and complete any missing record. Open email setup

Author: Heyşirket Editorial Team