Why Your App's Emails Land in Spam (SPF, DKIM, and DMARC Without the Jargon)

Your app sends a password reset, a receipt, or a shipping update, and it never arrives. Not because your code is broken, but because to Gmail your message looks exactly like something a spammer would send: a new domain, a server nobody has seen before, and no proof you are who you say you are. The fix is not clever copywriting, it is three records sitting quietly in your domain's DNS settings, usually set up once and forgotten.

Three records that prove you are not pretending to be you

SPF, DKIM, and DMARC are not an acronym to memorise, they are three small DNS records that answer one question: is this email really from this domain? SPF lists which servers are allowed to send for you, DKIM signs each message so it cannot be altered in transit, and DMARC tells inboxes what to do with a message that fails both checks. Skip any one of them and a legitimate password reset starts to look identical, to a spam filter, to a forged one sent by someone else entirely. Most transactional email providers, the service your AI-built app sends through, give you the exact records to paste into your domain host; the part people skip is actually pasting them in.

Tell your AI: "Check whether our domain has valid SPF, DKIM, and DMARC records for the email service we send from, and write out the DNS records we are missing."

This is not optional anymore

Google and Yahoo now enforce this directly rather than leaving it as good practice. Since February 2024, any sender putting more than 5,000 messages a day through Gmail must have SPF and DKIM in place plus a DMARC policy, or the mail gets rejected outright rather than quietly filtered to spam. Most new apps start well under that volume, but the same three checks already decide whether your very first password reset reaches an inbox or simply disappears, long before you ever get close to that threshold, so there is no real reason to wait.

Tell your AI: "Confirm our outgoing email volume and set up DMARC with a safe starting policy, so we are ready well before we approach Google's bulk sender threshold."

Test it before a customer tells you it is missing

The failure mode here is silent: nobody emails you to say your emails did not arrive, because the emails that would tell you that are the ones failing too. Send yourself a test receipt and a test password reset to a Gmail and an Outlook address before launch, and check the full message header, not just which folder it landed in, since a quiet drop to spam looks completely fine from your side of the screen. Do this again after any change to your email service, your domain, or your hosting, since any of the three can quietly break a record that was working fine the week before.

Tell your AI: "Send a test transactional email to a Gmail and an Outlook address, show me the full email headers, and flag anything that would hurt deliverability."