{"id":2224,"date":"2026-08-13T15:00:00","date_gmt":"2026-08-13T15:00:00","guid":{"rendered":"https:\/\/gigatech.nl\/?p=2224"},"modified":"2026-08-13T15:00:00","modified_gmt":"2026-08-13T15:00:00","slug":"why-email-goes-to-spam","status":"publish","type":"post","link":"https:\/\/gigatech.nl\/en\/why-email-goes-to-spam\/","title":{"rendered":"Why Does Email Go to Spam? SPF, DKIM and DMARC Explained"},"content":{"rendered":"
\"Gigatech<\/figure>\n

A sent email is not necessarily a delivered email. Between clicking Send and reaching the inbox, the receiving provider evaluates your domain identity, sending IP, reputation, content and recipient behaviour. If one part is wrong, a legitimate message may land in spam or be rejected with an SMTP error.<\/p>\n

Email delivery has three layers<\/h2>\n
    \n
  1. Technical identity:<\/strong> DNS, SPF, DKIM, DMARC, PTR and a valid server hostname.<\/li>\n
  2. Reputation:<\/strong> historic behaviour of the domain and IP, complaints, bounces and blocklists.<\/li>\n
  3. Message and behaviour:<\/strong> content, links, sending rate, consent and recipient engagement.<\/li>\n<\/ol>\n

    A perfect SPF record cannot repair a purchased list. Conversely, a useful newsletter can still fail when authentication is missing.<\/p>\n

    SPF: which systems may send for you?<\/h2>\n

    SPF is a TXT record listing authorised senders. Include not only your mail server but also accounting software, CRM, newsletter services, web forms and ticketing systems. Publish one SPF record and respect the limit of ten DNS lookups. Leaving obsolete includes in place adds risk and complexity.<\/p>\n

    DKIM: a verifiable digital signature<\/h2>\n

    DKIM cryptographically signs outgoing messages. The receiving server retrieves the public key from DNS and verifies that relevant headers and content were not altered. Use a 2048-bit key where supported, rotate keys carefully and ensure every active service signs with your domain.<\/p>\n

    DMARC: alignment, policy and reporting<\/h2>\n

    DMARC checks whether the visible From domain aligns with a domain authenticated by SPF or DKIM. A sensible rollout normally begins with p=none<\/code> and reporting. Map legitimate senders before moving gradually to quarantine<\/code> and potentially reject<\/code>. Enforcing rejection before discovery can break invoices, forms or newsletters.<\/p>\n

    Reverse DNS and server identity<\/h2>\n

    The sending IP should have a PTR record pointing to a valid hostname. That hostname needs an A or AAAA record resolving back to the same IP. The SMTP banner or EHLO name should also make sense. Forward-confirmed reverse DNS is not an inbox guarantee, but a missing or generic PTR is a strong warning signal.<\/p>\n

    Reputation is built through behaviour<\/h2>\n