Why Your Emails End Up in Junk (And How to Fix It)

You send a perfectly good email to a potential client and it never gets a reply. Days later you find out it landed in their junk folder. It happens more than people realise — and in most cases it is entirely preventable with a few simple settings that take less than an hour to sort out.

This guide explains exactly why emails get flagged as spam or show as “unverified”, and walks you through the three technical fixes — SPF, DKIM, and DMARC — without drowning you in jargon. We will explain what each one does in plain English, why it matters, and what to actually do about it.

Why do emails end up in junk?

Email providers like Gmail, Outlook, and Apple Mail use automated filters to decide whether an incoming message is legitimate or suspicious. One of the main things they check is whether your email was actually sent from a server that is allowed to send on behalf of your domain.

If you have set up a professional email address (say, hello@yourbusiness.co.uk) but never configured the authentication settings behind it, those filters have no way to verify you are who you say you are. So they treat your email with suspicion — sometimes marking it as spam, sometimes showing a warning banner, sometimes silently burying it in junk.

The fix involves three DNS records: SPF, DKIM, and DMARC. DNS records are settings you add to your domain — think of them as instructions that tell the internet how your domain should behave. They live with your domain registrar (where you bought the domain) or your DNS provider, and you add them via a simple control panel.

SPF — the approved senders list

SPF stands for Sender Policy Framework. The name sounds technical but the concept is simple: it is a list you publish that says “these are the mail servers that are allowed to send email from my domain.”

When someone receives an email from you, their email provider checks your SPF record to see if it came from an authorised server. If the server that sent it is on the list, the email passes. If it is not, the email gets flagged.

What it looks like

An SPF record is a single line of text added to your DNS. If you use Google Workspace for email, it looks something like this:

v=spf1 include:_spf.google.com ~all

Your email provider (Google Workspace, Microsoft 365, or whoever hosts your email) will give you the exact record to add. It is usually a straightforward copy-and-paste into your DNS settings.

One SPF record per domain

You can only have one SPF record per domain. If you send email from multiple services (for example, your main inbox plus a marketing tool like Mailchimp), they all need to be combined into a single record. Most email providers explain how to do this in their setup guides.

DKIM — your email’s digital signature

DKIM stands for DomainKeys Identified Mail. Where SPF says “this server is allowed to send from our domain”, DKIM goes one step further: it adds a digital signature to every email you send, which proves the message has not been tampered with in transit.

Think of it like a wax seal on a letter. When the recipient’s email server opens it, it checks the seal matches. If the email was intercepted and altered along the way, the seal breaks and the email gets flagged.

How to set it up

DKIM requires two things: a key generated by your email provider, and a corresponding DNS record added to your domain. Your email provider generates both and gives you the DNS record to add — you do not need to understand the cryptography behind it, just paste in what they give you.

In Google Workspace, you find this under Apps → Google Workspace → Gmail → Authenticate email. In Microsoft 365, it is under the Defender portal under Email & Collaboration → Policies & Rules. Both walk you through the steps.

DMARC — the policy that ties it together

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It is the record that tells receiving email servers what to do if an email fails the SPF or DKIM checks — and it is the one that stops other people from impersonating your domain.

Without DMARC, a scammer could potentially send emails that appear to come from your domain. DMARC puts a stop to that by publishing a clear policy: if an email claims to be from us but fails authentication, here is what you should do with it.

The three DMARC policies

• none — do nothing, just send me reports. Good for monitoring when you first set things up.
• quarantine — move failing emails to the spam folder. A sensible middle ground.
• reject — block failing emails outright. The most protective option once you are confident everything is set up correctly.

A basic DMARC record to get started looks like this:

v=DMARC1; p=none; rua=mailto:hello@yourbusiness.co.uk

The rua part is an email address where you want to receive weekly reports about who is sending email on behalf of your domain. Replace it with your own address. Start with p=none to observe for a week or two, then move to p=quarantine once you are happy everything is working.

The quick-win checklist

Here is a summary of everything to check. Work through these in order and your emails will be in much better shape:

1. Add an SPF record — get the correct record from your email provider and add it to your DNS as a TXT record on your root domain (@).
2. Enable DKIM — follow the setup steps in your email provider’s admin panel. They generate the key; you add it to DNS.
3. Add a DMARC record — start with p=none and a reporting email, then tighten the policy after a week once you can see no legitimate emails are failing.
4. Test with a tool — use MXToolbox or Mail Tester to send a test email and check your score. Both are free and show exactly what is passing and what is not.
5. Check your sending reputation — if you have been sending from an unverified domain for a while, your domain may have a poor reputation. Google Postmaster Tools (free) lets you monitor this over time.

How long does it take to work?

DNS changes can take anywhere from a few minutes to 48 hours to propagate globally, though most take effect within an hour. Once all three records are in place and verified, you should see a noticeable improvement in deliverability within a few days as mail providers update their view of your domain’s reputation.