Guide · Email

Stop your email going to spam, and stop others faking it.

Short answer: Publish three DNS records on your domain: SPF (which servers may send as you), DKIM (a signature your email provider adds) and DMARC (what receivers should do with mail that fails both). Since February 2024 Gmail and Yahoo require SPF or DKIM from every sender and DMARC from bulk senders, so without them your receipts and password resets land in spam, and anyone can send email that looks like it came from you.

Run the free quick check → See the steps
Updated 25 October 2026

What to do, step by step

The setup takes about half an hour in your domain's DNS settings.

  1. Add an SPF record

    One TXT record on your domain that lists everything allowed to send for you. Your email providers give you the exact include:

    yourdomain.com  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net -all"

    Only one SPF record per domain; merge them if you have two. End with -all (reject others) once you're sure the list is complete; ~all is the softer step before.

  2. Turn on DKIM at each sender

    In Google Workspace, Microsoft 365, Resend, Postmark, SendGrid and others, enable DKIM and add the record they show you (usually a TXT or CNAME at something._domainkey.yourdomain.com).

  3. Publish DMARC, starting gently

    _dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

    p=none only collects reports. After a few weeks of clean reports, move to p=quarantine and then p=reject, which is what actually stops forgery.

  4. Check the result

    Send a mail to a Gmail address, open it, and choose Show original: SPF, DKIM and DMARC should all say PASS. Or check the records from a terminal:

    dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com

  5. Protect domains that never send

    A domain you don't send from should say so, or it is free to forge: v=spf1 -all and v=DMARC1; p=reject.

What vibeship checks for you

You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.

Checked automatically

  • The free quick check looks for a mail server record, SPF and DMARC on your domain, and DKIM on the common default selector
  • The extensive scan grades how strict they are (-all vs ~all, p=reject vs p=none) and tries more DKIM selectors
  • DNS lookups only: we never send mail as you

Deeper, and what we don't check

  • DKIM on a selector we don't guess can be missed; we say "couldn't find", not "missing"
  • We don't send a test mail or measure your spam score
Run the free quick check → See a demo report

Questions people ask

Do I need all three?

Yes. SPF and DKIM prove a mail is genuine; DMARC tells receivers to act when it isn't, and is the only one that stops someone forging your exact address.

Will p=reject stop my own email?

It can, if a service sends as you without being in SPF or signing with DKIM. That's why you start at p=none and read the reports first.

Why do my password reset emails go to spam?

Usually missing or failing SPF, DKIM or DMARC, or sending from a shared domain. Send from your own domain through a transactional provider with all three set up.

Best effort, not a guarantee: Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Your site's safety stays your responsibility. Read the terms.

Sources

Sources checked on 25 October 2026.

Related guides