Why mail from your domain lands in spam
Mail from your domain leaves the server, and the recipient finds it in spam or does not see it at all. Usually the other server is not sure you are allowed to send for that domain. Three DNS records cover that: SPF, DKIM, and DMARC.
SPF: who is allowed to send
SPF lists the servers that may send mail for the domain. If messages leave from the VPS, that address has to be in the record. Your IP missing from the list, or someone else's server present in it, is a common reason for rejection. A domain should have one SPF record. A second one does not extend the first. It breaks the check.
DKIM: the signature on the message
DKIM signs the message, and DNS publishes the key used to check that signature. The mail system on the server adds the signature. If the key is not in DNS, there is nothing to check, and the recipient sees no signature. The key in DNS and the key on the server have to be a pair.
DMARC: what to do when the check fails
DMARC tells the recipient how strictly to treat SPF and DKIM. Start with a mode that only collects reports and rejects nothing. When ordinary mail passes both checks steadily, you can tighten the policy. A reject-everything mode on day one easily cuts off honest mail too.
An order that saves a round of email
- one SPF record with every real sender: the hosting server and external mail, if you use it;
- DKIM on both the server and in DNS;
- DMARC in report-only mode first;
- a test from an outside mailbox, not from the same server that sent the message.
The From address should be on the domain these records were made for. A message "from" one domain that left through another domain's servers reads as a fake to the recipient, even when the text is honest.
