wpri.me Technical Solutions
Troubleshooting Solution

Are Your Emails Landing in Your Clients' Spam Folders?

Fix email delivery issues, solve 'going to spam' problems, and correctly configure SPF, DKIM, and DMARC records.

Common Symptoms & Red Flags

  • Emails sent from your business domain go straight to the junk folder
  • Gmail displays a warning: 'This message could not be verified'
  • Transactional emails (invoices, receipts) never reach your customers
  • You receive bounceback reports stating 'Authentication Required'
  • Failing SPF, DKIM, or DMARC tests on tools like MXToolbox

How to Fix This:

We provide a step-by-step DIY guide below to help you resolve this manual configuration issue. However, if you are pressed for time, lack CLI/DNS access, or want to guarantee the problem is resolved securely, you can hire a verified contractor.

Skip to Expert Recommendation

Complete Guide to Fixing Email Authentication & Deliverability

New security rules enacted by Google and Yahoo require all domain senders to have authenticated email infrastructure. If you don’t configure SPF, DKIM, and DMARC correctly, your business emails will be automatically rejected or sent to spam folders.

1. Fix the SPF (Sender Policy Framework) Record

SPF is a simple TXT record added to your DNS provider that defines which IP addresses and servers are allowed to send emails on behalf of your domain.

  • Rule #1: Only One SPF Record. Having multiple TXT records starting with v=spf1 is a violation of standards and will cause checks to fail.
  • Merge Your Senders: If you use Google Workspace, Mailchimp, and Shopify, combine them into one record:
    • Google: include:_spf.google.com
    • Mailchimp: include:servers.mcsv.net
    • Shopify: include:shops.shopify.com
    • Merged Result: v=spf1 include:_spf.google.com include:servers.mcsv.net include:shops.shopify.com ~all
  • Use ~all (SoftFail) or -all (HardFail) at the end of your record to specify policy stringency.

2. Generate and Configure DKIM Keys

DKIM signs your outgoing emails cryptographically, proving that the email header hasn’t been tampered with mid-transit.

  1. Log in to your email provider dashboard (Google Admin Console, Microsoft 365, cPanel, etc.).
  2. Navigate to Email Settings > DKIM settings and click Generate New Record.
  3. Choose a selector name (typically google or selector1) and copy the public key generated.
  4. Log in to your DNS registrar (GoDaddy, Namecheap, Cloudflare, etc.).
  5. Add a new TXT Record with the Host Name [selector]._domainkey (e.g. google._domainkey) and paste the generated key in the value box.
  6. Go back to your email administrator console and click Start Authentication.

3. Deploy DMARC (Domain-based Message Authentication)

DMARC relies on the SPF and DKIM checks to decide what to do if an email fails authentication. It also sends reports outlining sending volumes and IP histories.

Create a new TXT record in your DNS settings:

  • Host Name: _dmarc (or _dmarc.yourdomain.com)
  • Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
    • p=none: Monitor mode. Emails that fail authentication will still be delivered. This is the safest way to start.
    • p=quarantine: Moves failed emails to spam/quarantine folders.
    • p=reject: Blocks failed emails entirely. Highly secure.
    • rua: The email address where DMARC XML alignment reports should be sent.

4. Verify Your Settings

Use troubleshooting checkers to check alignment:

  • MXToolbox SuperTool: Type your domain and check SPF, DKIM, and DMARC status.
  • Mail-Tester: Send an email to the generated address and inspect your deliverability rating out of 10.

DNS can be tricky to configure without errors. Adding duplicate tags or bad punctuation in SPF strings can break all email flow instantly. If you need a certified administrator to audit your setup and resolve authentication issues, hire Sarah Jenkins on Fiverr today.

💡
What Causes This Problem?

  • Missing or multiple conflicting SPF TXT records on your DNS zones
  • DKIM cryptographic keys not enabled or wrongly configured in Cloudflare or hosting
  • Incomplete DMARC setup causing strict inbox reject rates
  • Third-party senders (e.g. Mailchimp, HubSpot) not added into the main SPF policy
  • Incorrect registrar settings after changing web hosts

🛡️
How to Prevent Future Issues

  • Implement automated monitoring (e.g. UptimeRobot or Cron jobs) to catch anomalies early.
  • Conduct quarterly configuration audits (verify DNS propagation, core file hashes).
  • Maintain an offline disaster recovery backup vault before executing server-level updates.
Got Questions?

Frequently Asked Questions

What is SPF, DKIM, and DMARC?

SPF (Sender Policy Framework) lists the servers authorized to send mail from your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to verify the mail wasn't altered. DMARC tells receiving servers how to handle emails that fail SPF/DKIM.

Can I have multiple SPF records?

No, you must never have more than one SPF TXT record on your domain. Having multiple SPF records will cause servers to fail authentication checks. You must merge them into a single record instead.

How long does it take for DNS records to update?

DNS propagation typically takes anywhere from 1 hour to 24 hours depending on the Time-To-Live (TTL) settings of your registrar.

Affiliate Disclosure: We curate and recommend services and tools that we believe will solve your technical challenges. If you click on some of the links here (such as Fiverr or web hosting links) and make a purchase, we may earn a referral commission at no additional cost to you. This support helps us test services, maintain our platform, and continue providing free, high-quality technical guides. Thank you!