Emails Going to Spam? SPF, DKIM and DMARC Explained

Published 2026-10-12 · Updated 2026-11-01 · 8 min read

You send a quotation to an important client, and two days later they call to say they found it by chance in their spam folder, or never found it at all. When your emails are going to spam again and again, the cause is rarely the wording or the attachment. Most of the time it is three small DNS records that are missing or wrong: SPF, DKIM and DMARC. This guide gives you SPF, DKIM and DMARC explained in plain language, with records you can copy, the mistakes we see most often at Egyptian businesses, and a simple way to check the result yourself.

Why are my emails going to spam in the first place?

Email was designed decades ago with no built-in way to prove who the sender is. Any server in the world can send a message that claims to come from info@yourcompany.com. That gap is exactly what phishing exploits: a message that looks like it is from your bank or your courier, sent by a fraudster.

Large mailbox providers such as Gmail and Outlook now ask three questions about every incoming message:

• Is the sending server allowed to send for this domain? (SPF)
• Is the message digitally signed by the domain owner and unchanged in transit? (DKIM)
• What does the domain owner want us to do if the checks fail? (DMARC)

If the answers are unclear, the provider plays safe: it files your message in spam or rejects it. Domain reputation, complaints and content matter too, but these three records are the foundation you cannot skip.

Still using a free mailbox for work? Start with how to create an email with your company name, then come back here.

SPF: the list of servers allowed to send

SPF is a TXT record on your root domain that lists the servers and services allowed to send mail as you. A message from a server that is not on the list looks suspicious.

Type	Name	Value
TXT	@	v=spf1 include:_spf.orderatkeg.com ~all

• v=spf1 declares an SPF record.
• include:_spf.orderatkeg.com authorises every server listed by your mail service.
• ~all marks everything else as suspicious (soft fail). The stricter -all rejects everything else; use it only once you are sure every legitimate sender is listed.

The golden rule: one SPF record per domain

This is the most common mistake. A shop owner in Nasr City uses business email, then signs up for an accounting app that sends invoices in the shop's name. The app says "add this SPF record", so a second record is created next to the first. Two records starting with v=spf1 make SPF fail completely (a "PermError"), so delivery gets worse, not better.

The fix is to merge. If you have:

• v=spf1 include:_spf.orderatkeg.com ~all
• v=spf1 include:spf.invoices-app.example ~all

delete both and publish a single record:

v=spf1 include:_spf.orderatkeg.com include:spf.invoices-app.example ~all

One v=spf1 at the start, all the includes in a row, one ~all at the end. Also note that SPF evaluation is limited to ten DNS lookups, so remove includes for services you no longer use.

DKIM: a digital signature on every message

DKIM adds a hidden digital signature to the headers of each outgoing message. It is created with a private key that only the mail server holds; the matching public key is published in DNS so any receiver can verify it. If the message is altered or sent by someone without the key, the signature fails.

A DKIM record is a TXT record named after a "selector" followed by ._domainkey. At Orderatk the selector is s1:

Type	Name	Value (shortened)
TXT	s1._domainkey	v=DKIM1; k=rsa; p=MIIBIjANBgkq...

The real value is very long; never type it by hand, copy it from the control panel. Unlike SPF, DKIM has no "one record" problem: each sending service can use its own selector, so s1 for your mailboxes and another selector for your invoicing app can live side by side.

DMARC: policy and reports

DMARC ties SPF and DKIM to the address your client actually sees in the From field. It is not enough for SPF or DKIM to pass; the passing domain must match your visible domain (this is called alignment). DMARC also tells providers what to do on failure and asks them to send you reports.

Type	Name	Value
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com

Roll it out in stages: none, then quarantine, then reject

1. p=none: monitor only. Delivery does not change, but reports start arriving at the rua address and reveal everyone sending as your domain, including things you forgot, like the website form or the invoicing app. Stay here for a few weeks.
2. p=quarantine: once all legitimate sources pass, ask providers to put failing mail in spam. You can start with a partial rollout such as pct=25 and raise it.
3. p=reject: failing messages are refused outright. At this point it becomes very hard for fraudsters to impersonate your company in phishing mail to your customers.

DMARC reports are compressed technical files. Send them to a separate mailbox or alias so they do not clutter your main inbox.

Reading Gmail "Show original" to see why emails go to spam

The easiest free test: send a message from your business address to a personal Gmail account and open it in a desktop browser.

1. Click the three dots next to the Reply button.
2. Choose "Show original".
3. At the top you will see a small table with SPF, DKIM and DMARC lines.

You want PASS on all three, with your domain (or your mail service's domain for SPF) shown next to them. If you see:

• SPF: FAIL or SOFTFAIL: the sending server is not in your SPF record, or you have two SPF records.
• DKIM: FAIL or no DKIM line: the s1._domainkey record is missing or was pasted incompletely.
• DMARC: FAIL: SPF and DKIM probably passed for a different domain than yours, typical of apps that send on your behalf.

In the message view you can also click the small arrow under the sender's name and check "mailed-by" and "signed-by"; both should show your domain.

What big mailbox providers expect from bulk senders

Major mailbox providers have tightened their rules for anyone sending large volumes, such as newsletters and promotions. In short they expect:

• SPF and DKIM set up and passing.
• A published DMARC record, even if the policy is p=none.
• The From domain aligned with the domain that passed authentication.
• A clear, easy unsubscribe link in marketing mail, honoured promptly.
• A very low rate of spam complaints.

Even if you never send newsletters, these rules affect everyone, because providers are now less tolerant of unauthenticated domains. For large campaigns, use a dedicated bulk-sending service rather than an ordinary mailbox, and add it to the same SPF record with its own DKIM.

Common scenarios at Egyptian businesses

Invoices from accounting software land in spam

A supplies company in Alexandria issues invoices from an online accounting app, which emails them with accounts@company.com in the From field. But the message really leaves from the app's servers, so SPF and DMARC fail. Two fixes:

• If the app supports custom SMTP, enter your mailbox details: server mail.orderatkeg.com, port 465 with SSL or 587 with STARTTLS, username = the full email address. The invoice then leaves from your own mailbox and passes every check.
• Or add the app's include to your existing SPF record (merge, never a second record) and enable the app's DKIM if it offers one.

WordPress contact form messages never arrive

A clinic in Mansoura has a WordPress site with a booking form. By default WordPress sends mail with PHP's basic mail function straight from the web server, without your domain's DKIM signature, so form messages land in spam or vanish. The fix is WP Mail SMTP, available in one click from the Orderatk panel on WordPress hosting:

1. Create a dedicated mailbox such as website@clinic.com.
2. In WP Mail SMTP choose "Other SMTP", host mail.orderatkeg.com, port 465 with SSL.
3. Username is the full address, plus its password.
4. Set the From address to the same mailbox and send a test from the plugin.

If your site is built with the website builder instead, its contact form sends to your email and also stores each message in the Messages tab, so no enquiry is lost.

Changing mail provider and forgetting old records

After moving email away from your current provider, an old SPF or MX record often stays behind. Review every TXT record after the move and remove anything belonging to the old provider. Each record type is explained in DNS records explained: A, CNAME, MX and TXT.

Practical checklist: fix SPF, DKIM and DMARC in fifteen minutes

1. Open the DNS management page at your domain registrar.
2. Make sure MX points to mail.orderatkeg.com with priority 10.
3. Look for a TXT record starting with v=spf1. If one exists, add include:_spf.orderatkeg.com to it; if not, create it.
4. Add the s1._domainkey record with the value copied from the Orderatk panel.
5. Add _dmarc with p=none first.
6. Wait for propagation, then test with Gmail "Show original".
7. After a few weeks of clean reports, move to quarantine, then reject.

Connecting the same domain to your website too? The connect your domain page lists every record. To set up mailboxes on your phone afterwards, see business email on your phone and Outlook.

What Orderatk does for you

When you add your domain to Orderatk business email, we generate a DKIM key for that domain automatically (selector s1), show MX, SPF, DKIM and DMARC records ready to copy, and sign every outgoing message. On the incoming side we filter spam into the Junk folder and scan attachments for viruses. Each mailbox also has an hourly sending limit, so one hacked mailbox cannot damage sending reputation for everyone else.

If your emails keep going to spam and you want a clean start with correct records from day one, have a look at our plans and pricing; you can start with the Email only plan or a plan that combines website and email.

FAQ

Why are my emails going to spam when the content is normal?

Usually because SPF, DKIM or DMARC is missing or wrong, so the receiving provider cannot confirm the message is really from you. Send a test to Gmail and use Show original.

Can a domain have two SPF records?

No. Two records starting with v=spf1 make SPF fail. Merge all includes into a single record ending in ~all.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send, DKIM digitally signs each message, and DMARC defines what happens on failure and sends you reports.

Should I start DMARC with p=reject?

It is not recommended. Start with p=none, read the reports, move to quarantine, and switch to reject once every legitimate sender passes.

Why do my WordPress contact form emails not arrive?

WordPress sends from the web server without authentication by default. Use the WP Mail SMTP plugin connected to a real mailbox on your domain.

Read also