So you sent an important email to a client. They never responded. A week later you find out it landed in their spam folder. Here's the thing: it's probably not your email content. It's that Gmail, Outlook, and Yahoo can't verify the email actually came from you.
Think of it like sending a letter. If the return address looks sketchy—or there's no return address at all—the mailman gets suspicious. Email works the same way. There are three things that tell email providers "yes, this really came from who it says it came from." They're called SPF, DKIM, and DMARC. I know, terrible names. But they're actually pretty simple once you understand what they do.
Why This Matters Now More Than Ever
In February 2024, Google and Yahoo started requiring proper email authentication for anyone sending more than 5,000 emails a day. Microsoft followed in May 2025 with similar rules.
The result? Gmail reduced unauthenticated email delivery by 65%. That's not a typo. If your emails aren't properly authenticated, you've got a 65% higher chance of hitting spam.
On the flip side, businesses with proper authentication see 85-95% inbox placement. That's the difference between most of your emails landing in the inbox versus most of them disappearing into a black hole.
Thing #1: SPF (Your Email's Return Address List)
SPF stands for "Sender Policy Framework." In plain English: it's a list of servers that are allowed to send email on behalf of your domain.
Imagine you run a business called Smith Plumbing. You might send emails directly from your computer, through your website's contact form, and through a newsletter service like Mailchimp. SPF tells Gmail: "Hey, emails from smithplumbing.com can legitimately come from these three places."
Without SPF, anyone could send an email pretending to be from smithplumbing.com. With it, Gmail checks: "Did this email come from an approved server? If not, treat it as suspicious."
The problem? Nearly 40% of domains don't have SPF set up at all. That's 4 in 10 businesses making it easy for scammers to impersonate them—and making their own legitimate emails look suspicious.
Thing #2: DKIM (Your Email's Wax Seal)
DKIM stands for "DomainKeys Identified Mail." Think of it like the wax seal on an old-fashioned letter. It proves the email hasn't been tampered with since it left your server.
When you send an email with DKIM enabled, your server adds an invisible digital signature. The receiving server checks that signature against a key published in your domain's records. If they match, the email is verified as authentic and unaltered.
Without DKIM, there's no way to prove your email wasn't modified somewhere along the way. Spammers often intercept and modify legitimate emails, so email providers are suspicious of unsigned messages.
Thing #3: DMARC (Your Email's Instructions for Failures)
DMARC stands for "Domain-based Message Authentication, Reporting, and Conformance." It builds on SPF and DKIM by telling email providers what to do when an email fails authentication.
Think of DMARC as the instructions you leave for the post office: "If someone tries to send a letter with my return address but they're not on my approved list and there's no valid seal, throw it in the trash."
DMARC also sends you reports showing who's trying to send emails as you. This is how you catch spammers impersonating your business—and how you verify your own systems are set up correctly.
Here's the concerning part: only about a third of domains have DMARC set up. The other two-thirds are leaving the door wide open.
How to Check If You're Set Up Correctly
You don't need to be technical to check this. There are free tools that do it in seconds.
Step 1: Check your SPF record
Go to MXToolbox's SPF checker and enter your domain (like smithplumbing.com). You want to see a green checkmark. If you see errors or "No SPF record found," that's your first fix.
Step 2: Check your DKIM record
This one's trickier because DKIM requires knowing your "selector" (a name your email provider uses). If you use Google Workspace, your selector is probably "google." Try MXToolbox's DKIM checker with your domain and selector.
Step 3: Check your DMARC record
Go to MXToolbox's DMARC checker and enter your domain. Look for a valid record. If it says "No DMARC record found," you need to add one.
What to Tell Your Email Provider
Found problems? Here's exactly what to ask for:
If SPF is missing or broken: "I need an SPF record added to my domain's DNS settings. Can you help me create one that includes all our email sources?"
If DKIM isn't enabled: "I need to enable DKIM signing for my domain. What DNS records do I need to add?"
If DMARC is missing: "I need to add a DMARC record to my domain. Can we start with a p=none policy so I can monitor before enforcing?"
If your provider doesn't know what you're talking about, that's a red flag. Any decent email or hosting provider should be able to help with this in under an hour.
The Good News: Adoption Is Growing Fast
Over 2.3 million organizations adopted DMARC in 2024 alone—more than double the rate from the previous year. Google and Yahoo's new requirements forced the issue, and businesses are finally getting this right.
But here's the catch: if you're still in the majority without proper authentication, you're now at a disadvantage. The email providers got stricter because so many businesses got their act together. Those who haven't are increasingly treated as suspicious by default.
One More Thing: Keep Your Spam Rate Low
Even with perfect authentication, you can still land in spam if too many people mark your emails as junk. Google specifically says to keep your spam complaint rate below 0.3%. That means if you send 1,000 emails, no more than 3 people should click "Report spam."
How to stay under that threshold:
- Only email people who actually signed up
- Make unsubscribing easy and obvious
- Don't email too often
- Send stuff people actually want to read
If people are marking you as spam, the authentication won't save you.
The Bottom Line
Your emails landing in spam isn't bad luck. It's usually missing authentication. SPF, DKIM, and DMARC take about an hour to set up properly, and the difference in deliverability is dramatic: 85-95% inbox placement with them, versus a coin flip without.
If you're sending important emails to clients and customers—invoices, appointment reminders, quotes—those emails need to arrive. This is the fix.
Need Help Figuring This Out?
Every YouGrow website comes with proper email authentication configured from day one. But even if you're not a client, I'm happy to take a look at your domain's email setup and tell you what's missing. Shoot me a message—it takes five minutes to check, and I'll tell you exactly what to ask your provider for.