SPF, DKIM, DMARC: why your emails end up in spam and how to fix it

Every day, your emails go out. But do they actually arrive? A recent study shows that between 15% and 20% of legitimate emails end up in spam or get blocked before they even arrive. For small businesses and nonprofits sending newsletters or emails to their customers, this is a real, often invisible problem.

Since 2024, Google, Yahoo, and Microsoft have tightened their requirements. Three protocols have become essential: SPF, DKIM, and DMARC. Here's what you need to know, without the jargon.

Most French businesses aren't protected

According to AFNIC, the organization that manages .fr domains, here's the situation in 2025:

In other words, 8 out of 10 French businesses have no DMARC protection. If you send newsletters or marketing emails, you're probably one of them.

SPF, DKIM, DMARC: what are they for?

These three protocols share a single goal: proving that your emails really come from you, and not from a scammer impersonating you.

SPF: who's allowed to send on your behalf?

SPF is a list you publish on your domain name. It specifies which services are authorized to send emails on your behalf (your mailbox, your newsletter tool, etc.).

Example with Google Workspace + Sendora:

DKIM: a signature on every email

DKIM adds an invisible signature to every email you send. The recipient's server checks that this signature is authentic and that the message wasn't altered in transit.

DMARC: instructions for when something goes wrong

DMARC tells receiving servers what to do if an email fails SPF or DKIM checks. Three options: ignore and report, send to spam, or block entirely.

What Google, Yahoo, and Microsoft have required since 2024

In February 2024, Google and Yahoo made these protocols mandatory for senders sending more than 5,000 emails per day. Microsoft followed in May 2025. In practice, without these configurations, your emails can be rejected outright.

The main requirements:

• SPF configured on your domain
• DKIM enabled in your sending tool
• DMARC published on your domain
• A one-click unsubscribe link in your emails
• A spam complaint rate below 0.3%

The 3 mistakes that land your emails in spam

1. Not setting up these protections at all

This is the most common mistake. Without SPF, DKIM, and DMARC, Gmail, Outlook, and Yahoo have no reason to trust your emails. They land in spam, or simply never arrive at all. And you won't know it, because no one tells you.

2. Using a sending tool without declaring it on your domain

When you use Sendora or another sending platform, there are two options. The first: send via a shared subdomain provided by the platform. It's quick, but your recipients can see the message doesn't come directly from your domain, which hurts your image and trustworthiness.

The second option, strongly recommended: add the DNS records Sendora provides to your domain. Your emails then go out authenticated from your own domain, as if you were sending them yourself. This is the configuration that really matters to spam filters.

3. Sending from an address that doesn't match your domain

Do you have a website at your-company.com but send from a Gmail address or a different domain? Spam filters check the consistency between the visible address and the technical domain. A single inconsistency is enough to make your emails look suspicious, and it opens the door to impersonation.

With Sendora, it's just copy-paste

No need to understand the technical details. From your Sendora dashboard, you get every line you need to add to your DNS, that is, in your domain host's interface (OVH, Gandi, Cloudflare...). Sendora tells you exactly what to paste, in which field, under which name.

What Sendora asks you to configure

• A TXT record: to prove to our sending infrastructure that you actually own the domain
• 3 DKIM records (CNAME type): these are the keys that sign every one of your emails with your domain. This is the key piece: they're what let your emails pass DMARC checks
• DMARC: to protect your domain against impersonation and receive reports on your sends

SPF, meanwhile, is often already in place with your host. Sendora checks it, but won't ask you to reconfigure it unless necessary.

Once the records are added to your DNS, you can run a verification check directly from Sendora. The platform shows you in real time which records are detected and which are still missing.

What happens without these protocols

Without SPF and DKIM, your emails have no proof of origin. Spam filters treat them with suspicion. Some of your contacts never see your messages, and you never find out.

Without DMARC, anyone can send emails pretending to be you. A scammer could contact your customers using your address, send them fake invoices, or ask for passwords. You'd never know.

Since late 2025, major mailbox providers have been rejecting emails from non-compliant senders outright. This is no longer a recommendation. It's a requirement.

In summary

SPF, DKIM, and DMARC are three simple configurations that make a big difference. They protect your sender reputation, improve your email deliverability, and prevent others from impersonating you.

Less than an hour of setup, lasting benefits. If you haven't done it yet, now's the time.