Why your emails get flagged
When you email an invoice and the customer swears they never got it, the problem usually isn't your wording. It's that your domain fails one or more of three checks that Gmail, Outlook, and Yahoo run on every incoming message: SPF, DKIM, and DMARC.
In February 2024, Google and Yahoo started enforcing these checks. Every sender now needs at least SPF or DKIM to reach Gmail inboxes reliably, and high-volume senders need all three. A domain with none of them gets treated like a possible forgery, and forgeries go to spam.
In plain terms: SPF is a public list of the mail servers allowed to send email for your domain. DKIM is a tamper-proof signature stamped on each message. DMARC tells the receiving server what to do with mail that claims to be from you but fails the other two checks. All three are short text records you add to your domain's DNS settings. No code, nothing to install, and they're free.
Run a two-minute test first
Before changing anything, find out what's actually broken. Go to learndmarc.com (free, no signup). It shows you a one-time email address. Send any message to that address from the account you use for invoices, and the page updates live with a pass or fail for SPF, DKIM, and DMARC, plus a play-by-play of what the receiving server saw.
A second way, if you'd rather stay in your inbox: send a test to any Gmail address, open the message, click the three-dot menu at the top right of it, and pick Show original. The summary at the top shows SPF, DKIM, and DMARC each marked PASS or FAIL.
If all three already pass, your spam problem is something else (see the FAQ). If any of them fail, keep going.
Open your DNS settings
Every fix in this guide is a record you add wherever your domain's DNS lives. That's usually the company you bought the domain from:
- GoDaddy: sign in at godaddy.com > My Products > Domains > click DNS next to your domain
- Namecheap: Domain List > Manage > Advanced DNS
- Cloudflare: dash.cloudflare.com > click your domain > DNS > Records
- Wix or Squarespace: your domain dashboard > look for DNS Records or Advanced DNS
Not sure who manages your domain? Type it into lookup.icann.org, check the registrar name in the result, and log in there.
Add SPF (10 minutes)
SPF is a single TXT record listing every service allowed to send mail as your domain. In your DNS panel, click Add record and enter:
- Type: TXT
- Name or Host: @ (some panels want your bare domain typed out instead)
- Value if your email runs on Google Workspace: v=spf1 include:_spf.google.com ~all
- Value if your email runs on Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
Hard rule: a domain gets exactly ONE SPF record. If a TXT record starting with v=spf1 already exists, edit it instead of adding a second one. Two SPF records cancel each other out and both fail. To allow another sender, add its include: value into the same record, separated by a space, before the ~all.
Turn on DKIM (10 minutes)
DKIM lives inside your email provider's admin area, then gets published in DNS.
Google Workspace: go to admin.google.com > Apps > Google Workspace > Gmail > Authenticate email. Pick your domain and click Generate new record, keeping the 2048-bit default. Google gives you a host name (google._domainkey) and a long TXT value. Add that as a TXT record in your DNS panel, wait for it to publish, then return to the same Admin page and click Start authentication.
Microsoft 365: go to security.microsoft.com > Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM. Select your domain and switch on Sign messages for this domain with DKIM signatures. Microsoft shows two CNAME records, selector1._domainkey and selector2._domainkey. Add both in your DNS panel, then flip the toggle on.
The values are long and a single dropped character breaks the whole thing. Copy and paste, never retype.
Add DMARC in monitor mode (5 minutes)
DMARC is one more TXT record in the same DNS panel:
- Type: TXT
- Name or Host: _dmarc
- Value: v=DMARC1; p=none; rua=mailto:you@yourdomain.com (swap in a real address you check)
p=none means monitor only. Nothing gets blocked, and providers send you reports on who's sending as your domain. The raw reports are unreadable XML, so point the rua address at a free digest service like Postmark's DMARC monitoring (dmarc.postmarkapp.com) and read the weekly summary instead. Once everything legitimate passes for a few weeks, change p=none to p=quarantine so forgeries go to spam. Don't jump straight to p=reject; if a tool you forgot about sends as your domain, reject gets its mail refused outright.
Prove it worked
DNS changes usually show up within an hour but can take up to 48 hours, so if a check still fails right away, test again the next day before touching anything.
Rerun the learndmarc.com test from the account you send invoices with. You want three green passes. Then do the Gmail Show original check on a real invoice email, since your invoicing app may send differently than your inbox does.
Last step, and people skip it: ask two or three regular customers to drag your most recent invoice out of their spam folder, click Not spam, and add your address to their contacts. Authentication fixes how new mail gets judged. It doesn't instantly repair the reputation your domain built while it was failing, and a few Not spam clicks from real customers speed that repair up.