If emails from your business address bounce or land in spam, the cause is usually three short lines of text in your domain settings. They're called SPF, DKIM and DMARC. Strict inboxes, like some city and county offices, block mail when those lines are missing.
You don't need to be technical to fix this. You do need to know which one is missing.
What each one does
SPF is a list of who's allowed to send email for your domain. If Google sends your mail, Google goes on the list. A message from a sender who isn't on the list looks fake.
DKIM is a digital signature on every message. It proves the email wasn't changed on the way and that your domain really sent it.
DMARC tells the receiving inbox what to do when SPF or DKIM fail. Let it through, send it to spam, or block it. It also sends you reports if anyone is pretending to be you.
Check yours first
The fastest test is a real email. Send a message from your business address to a Gmail account that isn't yours. Open it, click the three dots, and choose Show original.
Look for SPF, DKIM and DMARC at the top. You want to see PASS next to each one.
A free checker works too. Search for "MXToolbox SPF lookup", enter your domain, and it shows what's published.
Fix SPF
SPF is one line of text (a TXT record) on your main domain. If you use Google Workspace and nothing else to send email, it looks like this:
v=spf1 include:_spf.google.com ~all
Add it at your domain provider as a TXT record with the host set to @. If one already exists, change that one instead of adding a second.
A domain can have only one SPF record. Two of them break SPF completely, and it's an easy mistake to make. If you send from other services too, add their include: entries inside the same record, before the ~all.
Fix DKIM
In Google Workspace, you generate the signature yourself.
- Sign in to the Google Admin console as a super administrator.
- Go to Apps, then Google Workspace, then Gmail, then Authenticate email.
- Pick your domain and click Generate new record.
- Copy the host name and the long text value Google shows you.
- Add them at your domain provider as a TXT record.
- Go back to Google and click Start authentication.
If Google won't give you a key, you probably turned Gmail on within the last day or two. Google says to wait 24 to 72 hours after that, then try again.
Add DMARC last
Wait about 48 hours after SPF and DKIM are working. Then add one more TXT record with the host set to _dmarc:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com
Start with p=none. That means "watch and report, don't block anything yet." Once your reports look clean, you can tighten it to quarantine or reject later.
Where Amplify fits
Your Amplify emails go out through a separate sending setup that we configure for you. Its records live on their own subdomain, so they don't go into your main SPF record. Please don't edit or delete those records. See Which Domain Is for What and What Address Your Emails Come From.
How long it takes
Google says SPF and DKIM can take up to 48 hours to start working. Other DNS changes can take up to 72 hours. Test again after a day before you change anything else.
FAQ
Do I need all three?
Gmail's rule is SPF or DKIM for everyone who sends to it, and all three if you send more than 5,000 messages a day. Set up all three anyway. It takes about the same time and it closes the gap.
Can I add these myself?
Yes, if you can log in to where your domain is managed. If that's a mystery, email support@earnworthy.com before you change anything. DNS is easy to get wrong, and we'll walk through it with you.
Which records should I never delete?
Your Google MX records, and the records Amplify uses for sending. Delete the MX records and your inbox stops getting mail. See Setting Up Google Workspace Email on Your Domain.
I fixed it and some emails still bounce. Now what?
Send us the bounce message. The wording usually names the check that failed. Also see Bounced Emails and Bad Addresses.