The short version

Three DNS records tell Gmail and Outlook "this server is allowed to send mail on behalf of this domain". Without them, your mail looks like someone else's mail pretending to be yours. That's exactly what fraudsters do, so the filter treats it the same way.

The records are SPF, DKIM and DMARC. You don't need to understand how they work to have them. But it helps to know what they do.

First: check what Gmail itself says

Don't guess. Do this:

Send an email from your address (name@company.com) to any Gmail address — yours or a friend's.
Open the message in Gmail in a browser.
Three dots, top right → "Show original".

You'll see something like:

SPF:   PASS  with domain company.com
DKIM:  PASS  with domain company.com
DMARC: PASS

Three PASS lines and your authentication is fine — the problem is elsewhere (see below). If you see FAIL, SOFTFAIL or NEUTRAL, you've found your cause.

Second check, if you'd rather use a tool: mail-tester.com gives you an address, you send it a message, and you get a score out of 10 with a specific list of what's missing. Free, no signup.

What the three records do

SPF is a list: "mail from company.com comes from these servers." If a message arrives from somewhere else, the recipient knows.

One detail that trips up almost everyone: SPF checks the address bounces would go back to, not the sender you see in your inbox. So SPF can pass while the message still looks suspicious — that's what DMARC is for.

A rule people break constantly: you may only have one SPF record. Two records don't add up — the result is an error and everything fails. If you've added Google Workspace, then a newsletter service, then something else, check that you don't have two.

DKIM is a signature. Every outgoing message is signed cryptographically and the public key sits in DNS. The recipient verifies the signature and sees the content wasn't tampered with in transit.

You do not hand-write the DKIM record. Your provider generates it and hands you the exact text. Copy it verbatim, including trailing dots.

DMARC is the instruction for what should happen when the first two fail: nothing, spam folder, or reject. It's also the only one that requires the sender you see to match the domain that actually passed the check.

Setting them up — in this order

The order matters. The reverse order blocks your own mail.

DKIM and SPF first. Publish them, send a test to Gmail, confirm PASS on both.
Only then DMARC, and start at p=none. That means "watch, block nothing". Leave it there at least two weeks.
Then move gradually to p=quarantine, then p=reject — weeks between each step.

Going from nothing to p=reject safely takes about six weeks. You can do it in a day — and then your own invoices stop arriving and you find out from a customer.

You don't have to do this yourself. Tell us and we'll handle it.

"SPF passes, DKIM passes, still in spam"

Then it's reputation or content. In order of frequency:

The domain is new. A domain registered a month ago that suddenly sends 500 messages looks exactly like a spam campaign. Start slowly — normal personal correspondence for the first few weeks, not bulk sends.
You're sending a newsletter from your normal mailbox. Don't. Use a proper bulk-email service. A single recipient hitting "spam" carries far more weight than you'd think.
Your list is stale. Sending to 300 addresses of which 40 no longer exist is a strong spam signal. Clean out the bounces.
You're sending a single image. A message that's one big banner with no text looks like an advert, because it is one.
Shortened links (bit.ly and friends). Heavily suspicious. Use the full URL.
No way to unsubscribe. If you're sending anything that resembles marketing, it needs an unsubscribe link. Without one you're also in breach of GDPR.

Words like "free" and exclamation marks do count, but far less than folklore suggests. If authentication is clean and the list is clean, the wording is rarely the cause.

Your website's contact form lands in spam

Different case, same cause. The form sends from your website's server but with info@company.com as the sender — and that server isn't in your SPF list. The whole thing looks forged.

The correct fix: the form sends from an address on the server itself and puts your address in the "Reply-To" field. Then you hit Reply and it goes to the customer, while authentication stays clean.

If the site is ours, this is already how it works. If it isn't, tell us and we'll fix it.

Check the other direction too

If you aren't receiving mail, that's a different problem — MX records, not SPF. Email us the address and where the missing message was sent from.

Stuck?

Email contact@hostika-bg.com with your domain. Checking the three records takes minutes and we do it for free, whether or not your mail is hosted with us.

Your email is landing in spam — what to do