Is your email going to spam? Check SPF, DKIM and DMARC

Q: Which DMARC policy should I start with?

Start with p=none, meaning observation only, as Google recommends, and a reporting address in rua, ideally a separate mailbox such as dmarc@primer.bg. SPF and DKIM must already work before that, and Google advises waiting 48 hours after them. Move to p=quarantine only when the reports show that everything sent in the domain's name passes the check.

Q: Why do emails from my WordPress forms go to spam?

By default WordPress sends through PHP's mail() function without logging in to a mailbox, and some forms put the visitor's address, a Gmail one for example, in the From field. The message then claims to come from Gmail, but Gmail did not sign it. Put an address on your own domain in From and the visitor's address in Reply-To, and send through an SMTP plugin such as WP Mail SMTP or FluentSMTP with a mailbox on the domain.

# TagsEmailDomains

The WPhost team1 Oct 202616 min read

A customer never got the quote you sent. Your website form drops inquiries into the Spam folder of your own Gmail. Or mail from info@primer.bg arrives, but only after the recipient pulls it out of spam by hand. The cause is often simple. The mail server on the other side cannot confirm that the message really comes from your domain, and for that it needs three DNS records, known as SPF, DKIM and DMARC.

This guide shows what Gmail and Yahoo require, what each of the three records does, and where cPanel shows and repairs them. Then you check them with dig and with "Show original" in Gmail, and fix the mail that WordPress sends through your site forms.

Why mail from your domain lands in spam

When a message reaches Gmail, Gmail's server sees only what is written inside it. It says the sender is info@primer.bg, but anyone can write that. So the receiver checks the DNS of the domain to see who may send in its name, and whether the signature on the message is genuine. With nothing to check, the message becomes suspicious. Google writes on its sender guidelines page that messages without such a check can go to spam or be rejected with error 5.7.26.

In practice there are only a few causes. The domain has no SPF or DKIM record. A record was added twice, and for SPF and DMARC a double record is not accepted. Some of the mail leaves from a service that is not in the SPF record, for example a newsletter or invoicing tool. Or WordPress sends from an address like wordpress@primer.bg that has no mailbox.

Fixing it takes no programming, only a few DNS records and one test.

What Gmail and Yahoo require from senders

Google describes its requirements on the "Email sender guidelines" page. They apply to mail sent to personal Gmail addresses, meaning @gmail.com and @googlemail.com, and have been in force since 1 February 2024. From every sender Google asks for:

SPF or DKIM for the domain you send from.
Valid forward and reverse DNS records (PTR) for the server. This is handled on the server, not in your account.
A TLS connection when the mail is transferred.
Less than 0.3% of your messages marked as spam by recipients, according to Postmaster Tools.
Messages in the format set by RFC 5322.
No impersonating of Gmail addresses in the From field.

A bulk sender is one that sends about 5,000 messages a day or more to personal Gmail addresses. Bulk senders must have both SPF and DKIM, publish a DMARC record (the policy can be none), and the domain in From must match the SPF or DKIM domain. Their marketing mail must unsubscribe with one click.

In the "Email sender guidelines FAQ" Google also writes that from November 2025 it enforces the rules more strictly. Messages that do not meet them can be rejected, temporarily or permanently. Yahoo splits its requirements the same way on its sender page. Everyone needs SPF or DKIM, while bulk senders need both, plus a DMARC policy of at least p=none.

A small site is not a bulk sender, but the requirements for all senders apply to it too, and Google recommends all three records for every domain.

What SPF, DKIM and DMARC are

The three records are plain TXT records in the DNS zone of the domain. Each answers a different question. The examples are for primer.bg. In your DNS panel you fill in the same three things, a name, the type TXT and a value, which is the text in quotes.

SPF says who may send

SPF is a list of the servers that may send mail from your domain. The receiver takes the IP address the message came from and looks for it in this list. The record sits at the root of the domain.

DNS

; primer.bg, TXT record at the root of the domain
primer.bg.  IN  TXT  "v=spf1 +a +mx +ip4:203.0.113.10 ~all"

v=spf1 says this is an SPF record. +a and +mx allow the address of the domain and its mail servers, +ip4 adds the address of the server, and ~all means that everything else is suspicious but is not rejected outright. A domain may have only one SPF record, and with two the check ends in an error. If another service sends mail in your name, add its include (for example include:spf.mailer.example) to the same record. The specification allows at most 10 DNS lookups, and with more the check returns an error. include, a and mx count towards them.

DKIM is the signature on the message

DKIM is a digital signature. The server signs every outgoing message with a secret key that stays on it. The public key is in DNS, and the receiver checks the signature with it. That is how it knows the message comes from the domain and was not changed on the way.

DNS

; primer.bg, TXT record for the selector default
default._domainkey.primer.bg.  IN  TXT  "v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY"

The name has the form selector._domainkey.domain. The selector is its first part, and cPanel shows you the exact value. Here default is only an example. For personal Gmail addresses Google requires a key of at least 1024 bits and recommends 2048.

DMARC says what happens on failure

DMARC tells the receiver what to do with a message from your domain that fails the check, and where to send you reports. A message passes when SPF or DKIM passes and the domain the check confirmed matches the domain in the From field.

DNS

; primer.bg, TXT record at the name _dmarc
_dmarc.primer.bg.  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@primer.bg"

p=none means "just observe", and rua is the address for the reports. Here too only one record is allowed. According to RFC 9989, when there are several DMARC records for one name the receiver discards all of them.

Where cPanel shows and repairs the records

In cPanel open Email, then Email Deliverability. The table shows the state of the mail records of each of your domains, and every domain has two buttons next to it.

Repair lets cPanel fix the invalid records. Before you confirm, you see what it proposes and can copy or change the proposed record. After that cPanel checks the records again, which can take up to five minutes. Manage opens a page with sections for DKIM, SPF, DMARC and the reverse DNS (PTR).

If the DNS zone of the domain is elsewhere, for example at the registrar or in Cloudflare, cPanel cannot change it and Repair is not available. Then in Manage you press Copy next to the proposed record and add it by hand where the zone is. If your DNS panel does not split long records into parts of 255 characters by itself, choose View, then Split, for the DKIM key.

In the SPF section the Customize button lets you add other services that send in your name (Include List). By default cPanel proposes ~all, and it is best to leave it so until you are sure about all your sources of mail. In the DMARC section the Install the Suggested Record button adds the record itself, but only when the server is the authoritative DNS server of the domain. A DMARC record works only if SPF and DKIM are valid.

If you do not see Email Deliverability in cPanel, write to your host's support, because the host can switch this section on and off. The cPanel documentation also warns that with some server settings DKIM may not be checked for mail sent from PHP applications. So try a message from your site form too, besides one from a mailbox.

How to turn on DMARC in steps

Start with p=none. Google recommends exactly this at the start, and then tightening the policy towards quarantine or reject. Before that SPF and DKIM must already work, and Google advises waiting 48 hours after them.

In cPanel (Email Accounts) create a separate mailbox dmarc@primer.bg. There can be many reports, so Google recommends a dedicated mailbox or a group, not your personal address.
Add the DMARC record from above with p=none and rua=mailto:dmarc@primer.bg.
Follow the reports. The specification recommends that receivers send them at least once a day, and there are services that arrange them in a table.
When the reports show that everything sent in the name of the domain passes the check, change p=none to p=quarantine. Then messages that fail go to spam at the receivers that honor the policy.

DNS

; Change only p. There is one record, do not add a second one.
_dmarc.primer.bg.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@primer.bg"

How to check the records with dig and with "Show original" in Gmail

First see what is published in DNS.

Bash

# From your computer (macOS or Linux). Read only, changes nothing.
dig +short TXT primer.bg | grep spf1
dig +short TXT _dmarc.primer.bg
dig +short TXT default._domainkey.primer.bg

On Windows use nslookup -type=TXT primer.bg and the same for the other two names. You expect one record each for SPF, DMARC and DKIM. If you see two lines that start with v=spf1 or with v=DMARC1, the record is doubled and only one must stay. A long DKIM key may be shown by dig in several parts in quotes, which is normal. If there is no answer for DKIM, look in Manage for the selector you have.

Then run a real test. Send a message from a mailbox on the domain to a personal Gmail address. In Gmail open the message, press the three dots next to Reply (the More menu) and choose Show original. A new window opens with the headers of the message. Find the Authentication-Results line and see what follows spf, dkim and dmarc.

Text

# Authentication-Results in the headers of a message received in Gmail
spf=pass
dkim=pass
dmarc=pass

You want pass three times. For SPF the results neutral, softfail and fail mean that the record does not allow the sender's IP address. If dkim says body hash did not verify, something changed the message on the way, for example a note added at the end by another server. If the spf line is missing, the message never went through an SPF check. Google also has a tool, Admin Toolbox Messageheader, where you paste the headers and it reads them for you.

WordPress forms and the SMTP plugin

When a site form sends a message, WordPress hands it to the wp_mail() function. By default it uses the PHP mail() function, so the message leaves from the web server without logging in to a mailbox. If no sender address is set, WordPress uses wordpress@ and the domain of the site. The documentation adds that a returned true does not mean the message reached the recipient.

Two things often send the mail from such a form to spam. The first is the address in From. Some forms put the visitor's address there, for example name@gmail.com, while your server sends the message. The message claims to come from Gmail, but Gmail did not sign it. Google states plainly that impersonating a Gmail address in From can harm delivery. The right setup is a From address on your own domain and the visitor's address in Reply-To, so the reply still reaches them.

The second is the path of the message itself. An SMTP plugin changes it. It logs in to a mailbox on the domain with a user name and password and sends through its server, the way your mail program does. So the message leaves by the same path as your ordinary mail, SPF and DKIM apply to it, and when something goes wrong the SMTP server returns an error that the plugin can show. Plugins like this are WP Mail SMTP (the Other SMTP mailer) and FluentSMTP (Any SMTP).

Fill in the mailbox details in the plugin. Where to get the exact values is described in the guide to domain email in Outlook, Gmail and on your phone.

Text

# SMTP plugin settings in WordPress
SMTP server:    mail.primer.bg
Port:           465
Encryption:     SSL/TLS
Authentication: on
Username:       info@primer.bg
Password:       the password of the mailbox
From:           info@primer.bg

Send a test message from the plugin and from the form itself, then check it with "Show original", as above.

Checklist

I know which services send mail from my domain (the mailboxes, the site forms, the newsletter, the invoices).
DNS has exactly one record that starts with v=spf1.
There is a DKIM record for the selector that cPanel shows, and dig returns it.
There is exactly one record at _dmarc and it starts with p=none.
The DMARC reports arrive in a separate mailbox.
A test message to Gmail shows spf=pass, dkim=pass and dmarc=pass.
The site forms send through SMTP from an address on my domain, and the visitor's address is in Reply-To.
Before I change to p=quarantine, I have read the reports.

If you would rather not do it yourself

A small site with a few mailboxes and one form usually gets there with the steps above. If the mail is on your own server, with WordPress maintenance we set up SPF, DKIM and DMARC so that your mail does not land in spam. If you send through several services and do not know where to start, describe them in the inquiry form.

Frequently asked questions

Why does email from my domain go to spam?

Most often the recipient's mail server cannot confirm that the message really comes from your domain, because the SPF or DKIM record is missing. Another common cause is a double record, since two SPF or two DMARC records are not accepted, or a newsletter or invoicing service that sends in your name but is not in the SPF record. Sometimes WordPress sends from an address like wordpress@primer.bg that has no mailbox.

What do Gmail and Yahoo require from email senders?

From every sender Google asks for SPF or DKIM for the domain, valid forward and reverse DNS (PTR) for the server, a TLS connection and fewer than 0.3% of messages marked as spam. Bulk senders, who send about 5,000 messages a day or more to personal Gmail addresses, need both SPF and DKIM, a DMARC record and one-click unsubscribe. Yahoo splits its requirements the same way.

What is the difference between SPF, DKIM and DMARC?

SPF is a list of the servers allowed to send mail from your domain. DKIM is a digital signature the server puts on every message, and the public key in DNS lets the recipient check the message was not changed on the way. DMARC tells the recipient what to do with a message that fails the check and where to send you reports.

Can a domain have two SPF records?

No. A domain may have only one SPF record, and with two the check ends in an error. If another service sends mail in your name, add its include to the same record, keeping in mind that the specification allows at most 10 DNS lookups, counting include, a and mx. DMARC also allows only one record, because according to RFC 9989 a receiver discards them all when there are several.

Where in cPanel are the SPF, DKIM and DMARC records?

In cPanel open Email, then Email Deliverability, where a table shows the state of the records for each domain. The Repair button fixes invalid records, and Manage opens separate sections for DKIM, SPF, DMARC and PTR. Review the proposed SPF record before you confirm Repair, because cPanel proposes a record for its own server and may drop the include of another service you use.

Which DMARC policy should I start with?

Start with p=none, meaning observation only, as Google recommends, and a reporting address in rua, ideally a separate mailbox such as dmarc@primer.bg. SPF and DKIM must already work before that, and Google advises waiting 48 hours after them. Move to p=quarantine only when the reports show that everything sent in the domain's name passes the check.

How do I check whether my email passes SPF, DKIM and DMARC?

Send a message from a mailbox on the domain to a personal Gmail address, open it, press the three dots next to Reply and choose Show original. In the Authentication-Results line you want pass after spf, dkim and dmarc. If dkim says body hash did not verify, something changed the message on the way, such as a note added by another server.

Why do emails from my WordPress forms go to spam?

By default WordPress sends through PHP's mail() function without logging in to a mailbox, and some forms put the visitor's address, a Gmail one for example, in the From field. The message then claims to come from Gmail, but Gmail did not sign it. Put an address on your own domain in From and the visitor's address in Reply-To, and send through an SMTP plugin such as WP Mail SMTP or FluentSMTP with a mailbox on the domain.

Sources