Fix email that Gmail rejects or marks as spam

If mail from your domain is bouncing back from Gmail with an error that mentions authentication, or it sends fine but lands in spam, the cause is almost always the same: Gmail cannot prove the email really came from your domain, so it refuses to trust it.

Since 2024 Google and Yahoo have required every sending domain to authenticate its mail. That is a good thing. It is what stops a stranger from sending invoices with your domain in the from line. But it means two DNS records that used to be optional are now the price of admission.

The two records, plainly

SPF is a list, published in your DNS, of the servers allowed to send mail for your domain. When your message arrives, Gmail looks up the list and checks whether the server that delivered it is on it. One TXT record on the root of your domain:

v=spf1 a mx ~all

That short list means “the servers my domain’s own website and mail records point at may send for me”, which on our platform is exactly right, because your mail goes out from the same server that hosts you.

DKIM is a signature. Your mail server signs every outgoing message with a private key, and publishes the matching public key in your DNS so Gmail can verify the signature. The key lives at a subdomain called a selector. On our platform the selector is hostingcp, so the record sits at:

hostingcp._domainkey.yourdomain.com

SPF says “this server may send for me”. DKIM says “and this exact message was not altered on the way”. Gmail wants both.

Check before you change anything

Send an email from your domain to any Gmail address you control. Open it in Gmail, click the three dots, then Show original. The top of that page gives you a verdict in three lines:

SPF:   PASS
DKIM:  PASS
DMARC: PASS

If all three say PASS, authentication is not your problem and you can stop reading this section. Spam placement with passing authentication usually means content or reputation, which is a different fix: a shared link that blocklists hate, a burst of identical messages, or a brand new domain with no history. Warm up slowly and keep sending; history accumulates.

If SPF or DKIM says FAIL or SOFTFAIL, keep reading.

The fix when we run your DNS

If your domain uses our nameservers, both records are created automatically when your mailbox is set up. A FAIL here usually means the domain was migrated from another host and the old records came along. Open the DNS editor in the panel and check for two things:

1. More than one TXT record starting with v=spf1. That is an error in itself, receivers treat multiple SPF records as an automatic fail. Delete the old host’s one, keep ours.
2. A missing hostingcp._domainkey record. If it is not there, open a ticket and we will switch signing on for the domain; it takes minutes.

The fix when your DNS lives elsewhere

This is the case that catches people. If your domain’s DNS is at Cloudflare or your registrar, and only the website points at us, then our panel cannot publish anything for you. The records exist on our side but the world never sees them.

Copy both records into the DNS you actually use: the SPF TXT record on the root, and the DKIM key from the panel’s email authentication page onto hostingcp._domainkey. Two Cloudflare specifics worth knowing. TXT records cannot be proxied, so those copy over as they are. Your MX record must stay unproxied, grey cloud not orange, and keep pointing at your mail hostname; with the website proxied, that MX entry is what makes the SPF check pass, so if mail breaks the moment you enable Cloudflare, this is the first thing to look at.

Add DMARC once the first two pass

DMARC is the policy record that tells receivers what to do when SPF or DKIM fails, and Gmail now expects to find one. Start in monitoring mode:

_dmarc.yourdomain.com   TXT   "v=DMARC1; p=none"

p=none changes nothing about delivery, it just declares a policy exists. Once you have watched real mail pass for a few weeks, tighten it to p=quarantine.

Prove the fix landed

DNS changes take up to an hour to be seen everywhere. Then repeat the Show original test. When all three lines say PASS, you are done, and the change is permanent; this is not something you renew or maintain.

One honest warning: do not pay for a mail warmup service or resend a failed campaign to make up for lost time. Reputation recovers on its own once authentication passes, and a sudden blast is the one thing that slows that down.