Skip to main content

Email Deliverability: SPF, DKIM, DMARC and Staying Out of Spam

Set up your sending domain, DMARC and good sending habits so emails reach the inbox.

H
Written by Hub Support Team

If your emails land in spam, the fix is usually two things: send from a verified domain you own, and send in a way inbox providers trust. This article covers both.

What SPF, DKIM and DMARC mean (in plain English)

These are three small DNS records that live with your domain registrar. Together they prove to Gmail, Outlook and others that an email claiming to be from you really came from you.

  • SPF lists which services are allowed to send email for your domain.

  • DKIM adds a digital signature to each email so it cannot be tampered with.

  • DMARC tells inbox providers what to do if an email fails those checks.

The hub generates the SPF and DKIM values for you. You just copy them into your DNS.

Before you start

  • Pick a sending subdomain that is not used for anything else, for example mail.yourbrand.com. Do not use your main domain.

  • Have your domain registrar login ready.

Step 1: Add a dedicated sending domain

  1. In the left menu, go to Settings > Email Services.

  2. Open the Dedicated Domain and IP tab.

  3. Click Add Domain and type your sending subdomain, for example mail.yourbrand.com.

  4. If the hub offers to configure the DNS records automatically, follow the prompts.

  5. Otherwise, the hub shows a list of DNS records. Open your registrar's DNS settings and add each record exactly as shown, with no extra spaces.

  6. Return to the hub and click verify.

DNS changes can take up to 24 hours to spread. If verification still fails after that, recheck each record. Only one DKIM record per domain is supported, so remove any old DKIM record left by a previous provider.

Step 2: Add a DMARC record

Once SPF and DKIM are verified, add a DMARC record at your registrar:

  • Type: TXT

  • Name: _dmarc (on your sending domain)

  • Value: v=DMARC1; p=reject

Add this only after SPF and DKIM show as verified, otherwise legitimate emails can be rejected.

Step 3: Match your From address

Your From email should be on the same organisation domain as your sending domain. If you send from mail.yourbrand.com, use [email protected] or [email protected], never a Gmail, Yahoo or other brand's address. Set your reply-to to an inbox you check.

Step 4: Warm up a new domain

A brand new domain has no reputation. Build it gradually:

  • Start with your most engaged, opted-in contacts, not a cold list.

  • Keep early volume low (the first stage is up to 100 emails an hour and 1,000 a day) and increase over two to four weeks.

  • Use drip mode for bulk campaigns so emails go out in batches.

  • Avoid sudden spikes. Steady, predictable sending builds trust.

Habits that keep you out of spam

  • Send only to people who opted in. Double opt-in (form plus a confirmation click) is best.

  • Clean your list. Remove hard bounces immediately. Stop emailing anyone who has not opened or clicked in two months.

  • Always include an unsubscribe link. Add the Footer element in the email builder. Missing unsubscribe links are a fast route to spam.

  • Keep emails short and focused. Avoid spammy words, all caps and public link shorteners such as bit.ly.

  • Test before you send. Send a copy to mail-tester.com and fix anything it flags.

  • Monitor reputation. Add your domain to Google Postmaster Tools and watch spam rate and domain reputation.

Troubleshooting

  • "Domain already pointing to email server." Your subdomain has old MX or SPF records from another service. Remove them, then try again.

  • Records never verify. Check for a wildcard (*.yourdomain.com) record at your registrar. Remove it temporarily, verify, then add it back.

  • Still going to spam after setup. Allow warm-up time (up to four weeks), confirm MX and DMARC records with the MX Toolbox Email Health Report, and check your list hygiene.

Still stuck? Open the chat widget in the hub and our support team will help.

Did this answer your question?