Why my emails go to spam: SPF, DKIM, DMARC

Before you start

• Your Enhance login details (https://server.nbt-host.com).
• Where your domain's DNS is hosted: with us (the ns1 / ns2.nbt-host.ro nameservers) or with another provider. If you're not sure, see How to point your domain to NBT Host.
• A list of the services that send email on behalf of your domain: your invoicing software, newsletter platform, online store, website forms.
• A Gmail address of your own, for testing.
• We use the English names from the Enhance interface, exactly as they appear on screen. If the panel opens in another language, switch it to English from your account menu: “My account” » “Language”.

The three “ID papers” of an email

Anyone can write “From: office@firmata.ro” in an email. To protect themselves against forgeries, receiving servers check three things published in your domain's DNS:

• SPF — the list of servers allowed to send email on behalf of your domain. A message sent from a server that isn't on the list is suspicious.
• DKIM — a digital signature our server adds to every message. The recipient checks it against a public key in DNS and learns that the message really comes from your domain and wasn't altered on the way.
• DMARC — your rule for recipients: what to do if a message claims to be from you but fails SPF or DKIM. p=none means “just monitor”, p=quarantine — “put it in spam”, and p=reject — “reject it”.

Reverse DNS (PTR) also matters: the server's IP address must have a name. The NBT Host server has one: server.nbt-host.com.

Google requires everyone who sends to Gmail to have at least SPF or DKIM, and those who send more than 5,000 messages a day to have SPF, DKIM and DMARC together.

What we set up for you automatically

If your domain uses our nameservers (ns1.nbt-host.ro and ns2.nbt-host.ro), its DNS zone includes from the start:

DKIM is enabled separately for each domain. We enable it on your account's main domain at activation, and on the main domain of a website added later within an hour at most. On aliases and subdomains added to a website, you enable it yourself in Enhance (step 1).

If your domain's DNS is with another provider (Cloudflare, the company you bought the domain from, etc.), these records don't appear there on their own: you add them yourself (see the steps below and How to point your domain to NBT Host), or write to us and we'll tell you exactly what to add.

The steps

1. Check your domain in Enhance

1. In Enhance, click “Emails”. Next to each address you'll see two labels, DKIM and SPF, with their status: “Valid” — everything is fine; “Invalid” — authentication is enabled, but the DNS record is missing or wrong; “Disabled” — not configured.
2. To view or enable DKIM, go to “Websites” » your website » “Domains” and click “Manage” next to the domain.
3. In the page menu, choose “Email authentication” and turn on the DKIM toggle if it's off.
4. If the domain uses our nameservers, the record is added to the DNS zone automatically. After a short while, the status should change from “Not validated” to “Validated”.
5. If your DNS is with another provider, the page says “Your domain's DNS is hosted externally.” and shows you the “Record name:” and “Record value:”. Add a TXT record at your DNS provider with exactly that name and value. Enhance says propagation can take up to 48 hours; after that, DKIM shows as validated.

6. Also with external DNS, add SPF and DMARC at your DNS provider:

   • SPF, TXT on the domain: v=spf1 a mx ip4:185.230.138.193 ~all. The IP address in it keeps SPF valid even if your website goes through the Cloudflare proxy;
   • DMARC, TXT on _dmarc: v=DMARC1; p=none;.

   Keep in mind:

   • a domain can have only one SPF record — if one already exists, edit it instead of adding another;
   • at Cloudflare, paste the TXT value without quotes, and the mail record must be DNS only (gray cloud), not proxied.

2. Check a real message

1. From your address, send a message to a Gmail address of your own.
2. In Gmail on a computer, open the message. Next to Reply, click More » Show original.
3. At the top, look for the SPF, DKIM and DMARC lines. All three should show PASS.

3. Add the services that send on your behalf

Your invoicing software, newsletter platform, online store or CRM may send email “from” your address, but from their own servers. To keep SPF from failing:

1. Check the service's documentation for what to add to SPF (usually something like include:...) and whether it also gives you a DKIM record.
2. In Enhance, go to “Websites” » your website » “Domains” » “Manage” next to the domain » “DNS records” (details in The DNS zone editor: A, CNAME, MX and TXT).
3. Find the TXT record that starts with v=spf1, click “Edit” and add the service's part to “Value”, before ~all. For example: v=spf1 a mx include:exemplu-serviciu.ro ~all. Click “Save”.
4. For the service's DKIM, click “Add record”, choose the type the service requires under “Type” (usually TXT or CNAME) and fill in “Hostname” and the value exactly as the service gives them to you: for TXT the field is called “Value”, for CNAME “Is an alias of” (with a dot at the end). Under “Hostname”, enter only the part in front of the domain — Enhance adds the domain itself. Click “Create”.

If your DNS is with another provider, make the same change there. If you're not sure, write to us first: a mistake in SPF can send all of your domain's messages to spam.

4. It's not just DNS

• Website forms. If a form sends the message “from” the visitor's address (for example client@gmail.com), the message fails the checks, because our server isn't allowed to send on behalf of Gmail. In the form settings, set an address on your domain as the sender, and put the visitor's address in the Reply-To field.
• The content. Subject lines in capital letters, “FREE!!!”, a message that is just an image, shortened links or .zip and .exe attachments raise the spam score. The text should match the subject. Our server also checks outgoing messages: one that looks like spam is refused when you send it, and you get an error.
• Bulk sending. For newsletters, use a dedicated platform set up with SPF and DKIM. The sending limit is 200 emails per hour for each address and 200 per hour for what a website sends through PHP's mail function. Gmail requires messages reported as spam to stay below 0.3%, and asks bulk senders to offer one-click unsubscribe in marketing messages.
• New domains. A newly registered domain has no reputation yet. In the first few weeks, ask your important recipients to add you to their contacts or to move your message out of spam if they find it there.
• Forwarding. Messages forwarded automatically to Gmail may end up in spam (see Email forwarding and auto-replies).

If something doesn't work

• Under “Emails”, DKIM or SPF shows “Invalid”. Usually the DNS is with another provider and the records weren't copied there, or the old hosting's SPF is still in place. Add the records from step 1 at your DNS provider.
• DKIM shows “Disabled”. It isn't enabled on that domain. Enable it from “Domains” » “Manage” » “Email authentication”.
• Gmail shows SPF: FAIL or SOFTFAIL. The message was sent from a server that isn't in SPF — an external service or a forward. Add the service to SPF (step 3). If your DNS is at Cloudflare, also check that the IP address is in SPF (step 1).
• Gmail shows DKIM: FAIL or it's missing. The DKIM key is missing from DNS or was copied incorrectly (a missing character, extra quotes). Copy it again from “Email authentication”.
• A message is refused when sending. If the error mentions spam, the server's filter considered the message spam: change the subject and text, remove shortened links and archive attachments. If you sent a lot in a short time, you hit the 200-per-hour limit: wait an hour.
• You don't know whether the message went out. Write to us with the date, time and recipient address: we'll look for the message in the server log and tell you whether it was delivered, deferred or rejected, and what the recipient's server replied.
• Messages go to spam only with one provider, even though SPF, DKIM and DMARC pass. Most of the time it comes down to content or domain reputation. Write to us with an example (date, time, recipient address) and we'll also check the server's reputation.