If your legitimate emails are landing in spam or being spoofed by attackers, your authentication setup might be the problem. To make sure your emails are trusted, you need three essential protocols: SPF, DKIM, and DMARC.These technologies form the foundation of secure email delivery. Together, they prevent phishing, domain impersonation, and spam, ensuring that your messages reach the inbox safely.This guide explains what each protocol does, how they work together, and how to set them up correctly.<h2>Why Email Authentication Matters</h2>Every day, millions of phishing emails are sent pretending to be from legitimate companies. Without proper authentication, spammers can forge your domain name and send fake messages that look real.Strong email authentication:<ul><li>Protects your brand reputation</li><li>Improves deliverability</li><li>Increases user trust</li><li>Prevents unauthorized senders from using your domain</li></ul><h2>What Is SPF?</h2><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/spf-sender-policy-framework">SPF (Sender Policy Framework)</a> is a DNS record that specifies which mail servers are allowed to send emails on behalf of your domain.When an email is received, the receiving mail server checks the sender’s domain and verifies if the sending IP address is listed in the SPF record.If it matches, the SPF check passes. If not, it fails and may be marked as spam or rejected.Example SPF Record<pre><code>v=spf1 include:autosend.com -all
</code></pre>How it works:<ol><li>The receiving mail server extracts the domain from the “Return-Path” header.</li><li>It looks up the SPF record for that domain.</li><li>If the IP address sending the message matches one listed, the email is authenticated.</li></ol>Best Practices for SPF<ul><li>Use <code>-all</code> instead of <code>~all</code> to enforce strict validation.</li><li>Keep the record under 10 DNS lookups to avoid breaking SPF.</li><li>Update it whenever you add or remove an email service.</li></ul><h2>What Is DKIM?</h2><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dkim-domainkeys-identified-mail">DKIM (DomainKeys Identified Mail)</a> adds a digital signature to your emails to prove that the content has not been modified.Each outgoing email is signed with a private key that only your mail server knows. The recipient can then verify this signature using a public key stored in your domain’s DNS.Example DKIM Record<pre><code>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B...
</code></pre>How it works:<ol><li>Your mail server generates a DKIM signature and attaches it to each email header.</li><li>The receiving server fetches the public key from your DNS.</li><li>It verifies the signature to ensure that the email body and headers were not altered.</li></ol>Best Practices for DKIM<ul><li>Use at least a 2048-bit key for stronger security.</li><li>Rotate DKIM keys periodically (every 6–12 months).</li><li>Ensure your “From” domain matches the signing domain for alignment with DMARC.</li></ul><h2>What Is DMARC?</h2><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dmarc-domain-based-message-authentication-reporting-conformance">DMARC (Domain-based Message Authentication, Reporting, and Conformance)</a> ties SPF and DKIM together and defines what to do when an email fails authentication.DMARC allows you to tell receiving servers how to handle unauthenticated messages (none, quarantine, or reject) and provides detailed reports on who is sending emails using your domain.Example DMARC Record<pre><code>v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; adkim=s; aspf=s
</code></pre>How it works:<ol><li>The receiving server checks if the email passes SPF or DKIM.</li><li>It verifies if the domain in those checks aligns with the “From” domain.</li><li>Based on your DMARC policy (<code>p=</code>), it either delivers, quarantines, or rejects the message.</li></ol>Policy Options<ul><li><code>p=none</code>: Monitor only (no enforcement)</li><li><code>p=quarantine</code>: Mark suspicious emails as spam</li><li><code>p=reject</code>: Block unauthorized emails entirely</li></ul>Best Practices for DMARC<ul><li>Start with <code>p=none</code> to collect reports.</li><li>Review your DMARC reports for legitimate senders.</li><li>Move to <code>quarantine</code> and finally <code>reject</code> once everything is aligned.</li></ul><h2>How SPF, DKIM, and DMARC Work Together</h2>Think of SPF, DKIM, and DMARC as three layers of email defense.Layer Purpose Protects Against SPF Authorizes sending IP addresses Spoofing and unauthorized senders DKIM Signs messages to verify integrity Message tampering DMARC Enforces policy and alignment Phishing and domain abuseHere’s how the process works when you send an email:<ol><li>The recipient’s server checks if the sending IP is authorized by SPF.</li><li>It verifies the DKIM signature to ensure the message is intact.</li><li>It applies your DMARC policy to decide what to do with emails that fail either check.</li></ol>If both SPF and DKIM align with your domain and pass validation, your message is considered legitimate.<h2>How to Set Them Up for Your Domain</h2>Setting up these records takes just a few minutes but has long-term benefits.<h3>Step 1: Add SPF Record</h3>In your DNS settings, add a TXT record:<pre><code>v=spf1 include:autosend.com -all
</code></pre><h3>Step 2: Add DKIM Record</h3>Your email service provider (like AutoSend) gives you a DKIM key. Add it as:<pre><code>default._domainkey.yourdomain.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
</code></pre><h3>Step 3: Add DMARC Record</h3>Finally, publish your DMARC policy:<pre><code>_dmarc.yourdomain.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; aspf=s; adkim=s"
</code></pre>Once added, use tools like:<ul><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://mxtoolbox.com/">MXToolbox</a></li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.dmarcanalyzer.com/">DMARC Analyzer</a></li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.mail-tester.com/">Mail-Tester</a></li></ul>to confirm that everything is working.<h2>Why This Matters for Deliverability</h2>Mailbox providers like Gmail and Yahoo use these checks to decide whether to trust your domain. Without them, even legitimate emails can end up in spam. Strong authentication helps build domain reputation, leading to better inbox placement and fewer delivery issues.Once SPF, DKIM, and DMARC are properly configured, you can take authentication a step further with <a target="_new" rel="noopener" class="break-all link-break text-gray-500 hover:underline decorated-link" href="https://autosend.com/blog/how-to-get-a-verified-checkmark-in-gmail-with-bimi">BIMI (Brand Indicators for Message Identification)</a>. BIMI allows you to display your verified logo and checkmark next to your emails in supported inboxes, signaling authenticity and boosting brand trust.<hr><h2>TL;DR</h2>To protect your domain and ensure your emails reach the inbox:<ol><li>Set up SPF to authorize your sending IPs.</li><li>Enable DKIM to sign and verify message integrity.</li><li>Enforce DMARC to align and control authentication results.</li></ol>Together, these three protocols secure your brand, prevent abuse, and improve deliverability.

If your legitimate emails are landing in spam or being spoofed by attackers, your authentication setup might be the problem. To make sure your emails are trusted, you need three essential protocols: SPF, DKIM, and DMARC.These technologies form the foundation of secure email delivery. Together, they prevent phishing, domain impersonation, and spam, ensuring that your messages reach the inbox safely.This guide explains what each protocol does, how they work together, and how to set them up correctly.Why Email Authentication MattersEvery day, millions of phishing emails are sent pretending to be from legitimate companies. Without proper authentication, spammers can forge your domain name and send fake messages that look real.Strong email authentication:Protects your brand reputationImproves deliverabilityIncreases user trustPrevents unauthorized senders from using your domainWhat Is SPF?SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are allowed to send emails on behalf of your domain.When an email is received, the receiving mail server checks the sender’s domain and verifies if the sending IP address is listed in the SPF record.If it matches, the SPF check passes. If not, it fails and may be marked as spam or rejected.Example SPF Recordv=spf1 include:autosend.com -all
How it works:The receiving mail server extracts the domain from the “Return-Path” header.It looks up the SPF record for that domain.If the IP address sending the message matches one listed, the email is authenticated.Best Practices for SPFUse -all instead of ~all to enforce strict validation.Keep the record under 10 DNS lookups to avoid breaking SPF.Update it whenever you add or remove an email service.What Is DKIM?DKIM (DomainKeys Identified Mail) adds a digital signature to your emails to prove that the content has not been modified.Each outgoing email is signed with a private key that only your mail server knows.The recipient can then verify this signature using a public key stored in your domain’s DNS.Example DKIM Recordv=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B...
How it works:Your mail server generates a DKIM signature and attaches it to each email header.The receiving server fetches the public key from your DNS.It verifies the signature to ensure that the email body and headers were not altered.Best Practices for DKIMUse at least a 2048-bit key for stronger security.Rotate DKIM keys periodically (every 6–12 months).Ensure your “From” domain matches the signing domain for alignment with DMARC.What Is DMARC?DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and defines what to do when an email fails authentication.DMARC allows you to tell receiving servers how to handle unauthenticated messages (none, quarantine, or reject) and provides detailed reports on who is sending emails using your domain.Example DMARC Recordv=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; adkim=s; aspf=s
How it works:The receiving server checks if the email passes SPF or DKIM.It verifies if the domain in those checks aligns with the “From” domain.Based on your DMARC policy (p=), it either delivers, quarantines, or rejects the message.Policy Optionsp=none: Monitor only (no enforcement)p=quarantine: Mark suspicious emails as spamp=reject: Block unauthorized emails entirelyBest Practices for DMARCStart with p=none to collect reports.Review your DMARC reports for legitimate senders.Move to quarantine and finally reject once everything is aligned.How SPF, DKIM, and DMARC Work TogetherThink of SPF, DKIM, and DMARC as three layers of email defense.Layer Purpose Protects Against SPF Authorizes sending IP addresses Spoofing and unauthorized senders DKIM Signs messages to verify integrity Message tampering DMARC Enforces policy and alignment Phishing and domain abuseHere’s how the process works when you send an email:The recipient’s server checks if the sending IP is authorized by SPF.It verifies the DKIM signature to ensure the message is intact.It applies your DMARC policy to decide what to do with emails that fail either check.If both SPF and DKIM align with your domain and pass validation, your message is considered legitimate.How to Set Them Up for Your DomainSetting up these records takes just a few minutes but has long-term benefits.Step 1: Add SPF RecordIn your DNS settings, add a TXT record:v=spf1 include:autosend.com -all
Step 2: Add DKIM RecordYour email service provider (like AutoSend) gives you a DKIM key.Add it as:default._domainkey.yourdomain.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
Step 3: Add DMARC RecordFinally, publish your DMARC policy:_dmarc.yourdomain.com IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; aspf=s; adkim=s"
Once added, use tools like:MXToolboxDMARC AnalyzerMail-Testerto confirm that everything is working.Why This Matters for DeliverabilityMailbox providers like Gmail and Yahoo use these checks to decide whether to trust your domain.Without them, even legitimate emails can end up in spam.Strong authentication helps build domain reputation, leading to better inbox placement and fewer delivery issues.Once SPF, DKIM, and DMARC are properly configured, you can take authentication a step further with BIMI (Brand Indicators for Message Identification).BIMI allows you to display your verified logo and checkmark next to your emails in supported inboxes, signaling authenticity and boosting brand trust.TL;DRTo protect your domain and ensure your emails reach the inbox:Set up SPF to authorize your sending IPs.Enable DKIM to sign and verify message integrity.Enforce DMARC to align and control authentication results.Together, these three protocols secure your brand, prevent abuse, and improve deliverability.

Learn how SPF, DKIM, and DMARC protect your domain from spoofing and phishing, improve trust, and boost email deliverability.

How SPF, DKIM, and DMARC Work Together to Protect Your Domain

When you open an email from Apple or Google, you might notice a small blue checkmark or the brand’s official logo next to the sender’s name. That tiny icon is not decorative. It is a sign of verified authenticity, powered by BIMI (Brand Indicators for Message Identification).Implementing BIMI is one of the most effective ways to increase trust, visibility, and open rates for your <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/transactional-emails">transactional</a> and <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/marketing-emails">marketing emails</a>. This guide explains everything you need to know from DNS setup to logo requirements and verification so you can earn that verified checkmark for your brand.<h2>What Is BIMI?</h2>BIMI is an email authentication standard that allows brands to display their official logo next to their emails in recipients’ inboxes. It builds on top of <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dmarc-domain-based-message-authentication-reporting-conformance">DMARC</a>, <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/spf-sender-policy-framework">SPF</a>, and <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dkim-domainkeys-identified-mail">DKIM</a>, ensuring that only legitimate senders can use a company’s logo.In short:<ul><li>SPF verifies the sending IP address.</li><li>DKIM verifies that the message content has not been tampered with.</li><li>DMARC enforces alignment and policy.</li><li>BIMI adds a visual trust layer using your brand logo.</li></ul><h2>Why BIMI Matters</h2><ul><li>Boosts Trust: The verified logo signals authenticity and reduces phishing risk.</li><li>Increases Open Rates: Emails with visible brand logos stand out in crowded inboxes.</li><li>Enhances Brand Recognition: Your logo appears alongside your sender name across supported email clients.</li><li>Supports Deliverability: BIMI indirectly improves domain reputation through strong authentication.</li></ul><h2>Email Clients That Support BIMI</h2>BIMI is still growing in adoption but is already supported by major inbox providers.Currently supported by:<ul><li>Gmail (requires a Verified Mark Certificate)</li><li>Yahoo Mail</li><li>Apple Mail (macOS and iOS 16 and above)</li><li>Fastmail</li><li>AOL Mail</li></ul><h2>Step-by-Step Guide to Getting the Verified Checkmark with BIMI</h2>There are four main steps to implement BIMI correctly:<ol><li>Set up email authentication</li><li>Create and host your logo in the right format</li><li>Obtain a Verified Mark Certificate (VMC)</li><li>Publish your BIMI DNS record</li></ol>Let’s go through each step in detail.<h3>Step 1: Set Up Email Authentication (SPF, DKIM, and DMARC)</h3>BIMI works only if your email domain passes all authentication checks.1. Configure SPFSPF (Sender Policy Framework) ensures that only your authorized servers can send emails on behalf of your domain.Example DNS TXT record:<pre><code>v=spf1 include:autosend.com -all
</code></pre>Replace <code>autosend.com</code> with your actual email service provider’s sending domain.2. Configure DKIMDKIM (DomainKeys Identified Mail) adds a digital signature to your emails.Example DKIM DNS record:<pre><code>v=DKIM1; k=rsa; p=MIIBIjANBgkqhk...
</code></pre>Your ESP (like AutoSend) provides this key. Add it to your DNS as a TXT record (usually under a selector like <code>default._domainkey.yourdomain.com</code>).3. Configure DMARCDMARC enforces alignment between SPF and DKIM. It also tells receiving servers what to do when emails fail authentication.Example DMARC DNS record:<pre><code>v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain.com; sp=none; adkim=s; aspf=s
</code></pre>Make sure your policy (<code>p=</code>) is set to quarantine or reject. BIMI will not work if your DMARC policy is set to none.<h3>Step 2: Create and Host a BIMI-Compatible Logo</h3>Your logo must meet BIMI’s strict visual and technical requirements.Logo Requirements:<ul><li>Format: SVG Tiny Portable/Secure (SVG-P/S)</li><li>Shape: Square (1:1 aspect ratio)</li><li>No text or taglines</li><li>Transparent background</li><li>File size: Under 32 KB</li></ul>If your logo is not in SVG Tiny PS format, you can convert it using Adobe Illustrator or online tools like the <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://easydmarc.com/tools/bimi-logo-converter">BIMI Logo Generator</a>.Example file name:<pre><code class="language-bash">https://yourdomain.com/logo.svg
</code></pre>Host this logo on an HTTPS-secured URL without redirects.<h3>Step 3: Obtain a Verified Mark Certificate (VMC)</h3>To show a verified checkmark (especially in Gmail), you will need a VMC, a digital certificate proving that your organization owns the logo and trademark.How to get a VMC:<ol><li>Register your logo as a trademark with an official authority such as USPTO or EUIPO. This is required before applying for a VMC.</li><li>Buy a VMC from a trusted certificate authority:<ul><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.entrust.com/">Entrust</a></li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.digicert.com/">DigiCert</a></li></ul></li><li>Provide your trademark details, logo file, and proof of domain control during verification.</li></ol>The verification process usually takes 5 to 15 business days. Once approved, you will receive a <code>.pem</code> file that links your domain to your verified brand logo.<h3>Step 4: Publish the BIMI DNS Record</h3>After you have your logo and VMC, publish your BIMI record in DNS.Example TXT record:<pre><code>default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem"
</code></pre>Explanation:<ul><li><code>v=BIMI1</code> → version</li><li><code>l=</code> → location of your logo</li><li><code>a=</code> → location of your VMC file</li></ul>Note: The <code>a=</code> tag is optional for non-VMC implementations, but Gmail requires it for the verified checkmark.<h3>Step 5: Test Your BIMI Setup</h3>You can verify your BIMI configuration with these tools:<ul><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.bimigroup.org/bimi-generator/">BIMI Inspector</a></li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.valimail.com/bimi-inspector/">Valimail BIMI Checker</a></li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://mxtoolbox.com/BIMI.aspx">MXToolbox BIMI Lookup</a></li></ul>These tools check:<ul><li>DNS record syntax</li><li>SVG format</li><li>VMC validity</li><li>DMARC enforcement</li></ul>Once everything passes, your verified logo should appear in Gmail and other supported inboxes within a few days.<h2>Troubleshooting Common BIMI Issues</h2>Problem Cause Solution Logo not showing: <ul><li>Cause: DMARC policy set to <code>none</code> </li><li>Solution: Change it to <code>quarantine</code> or <code>reject</code> </li></ul>“No VMC found” error <ul><li>Cause: Missing or invalid <code>a=</code> tag </li><li>Solution: Add the correct VMC file URL </li></ul>Incorrect logo size<ul><li>Cause: SVG not compliant</li><li>Solution: Use SVG Tiny PS format </li></ul>No HTTPS<ul><li>Cause: Insecure logo hosting</li><li>Solution: Host logo and VMC over HTTPS</li></ul><h2>How Long Does It Take to Show?</h2>Once your BIMI record is published, it can take up to 7 days for mailbox providers to pick up and display the logo. Gmail may take a few extra days to cache the verification.<h2>The Business Value of BIMI</h2>Implementing BIMI is not just a technical task. It is a brand-building investment.<ul><li>Higher engagement: Users are more likely to open verified emails.</li><li>Reduced phishing risk: Impersonators cannot spoof your brand easily.</li><li>Consistent branding: Your logo is visible across inboxes, reinforcing recognition.</li><li>Improved deliverability: Providers trust domains that use BIMI.</li></ul><hr><h2>TL;DR</h2>To get a verified checkmark in Gmail and other inboxes:<ol><li>Set up SPF, DKIM, and DMARC with strict enforcement.</li><li>Create a square SVG Tiny PS logo and host it securely on HTTPS.</li><li>Register your logo as a trademark and obtain a Verified Mark Certificate (VMC).</li><li>Publish a BIMI DNS TXT record linking your logo and VMC.</li><li>Test and wait a few days for propagation.</li></ol>BIMI is becoming the modern trust signal for email, similar to the verified badge on social networks. By implementing it, you not only protect your brand but also show customers that you care about authenticity and security.If you are using AutoSend, BIMI setup is straightforward. AutoSend fully supports SPF, DKIM, and DMARC alignment, making it simple to authenticate and verify your domain.<hr><h2>Frequently Asked Questions (FAQ)</h2><h3>1. Does BIMI improve deliverability?</h3>Indirectly, yes. BIMI itself does not guarantee better inbox placement, but it relies on strong authentication. That improved trust and alignment positively impact your domain reputation and overall deliverability.<h3>2. How much does a Verified Mark Certificate (VMC) cost?</h3>A VMC usually costs between $900 and $1,500 per year, depending on the certificate authority. Some providers offer discounts for multi-year subscriptions.<h3>3. Can startups use BIMI without a trademark?</h3>Not if you want the verified checkmark in Gmail. Gmail requires a VMC, and a VMC requires a registered trademark. However, you can still implement BIMI without a VMC to display your logo in clients that support it without verification (such as Yahoo Mail).<h3>4. How long does it take to get verified after publishing BIMI?</h3>After publishing your BIMI DNS record and passing authentication checks, it usually takes 3 to 7 days for the logo and verified checkmark to appear in supported inboxes.<h3>5. What happens if my DMARC policy is set to “none”?</h3>BIMI will not activate. You must change your DMARC policy to quarantine or reject for BIMI to work.<h3>6. Do I need a separate BIMI record for subdomains?</h3>Yes, if you send emails from multiple subdomains, each subdomain should have its own BIMI record and logo configuration.<h3>7. Is BIMI supported in Outlook or Microsoft 365?</h3>Not yet. Microsoft has not implemented BIMI as of now, but it may support it in the future as adoption grows.

When you open an email from Apple or Google, you might notice a small blue checkmark or the brand’s official logo next to the sender’s name. That tiny icon is not decorative. It is a sign of verified authenticity, powered by BIMI (Brand Indicators for Message Identification).Implementing BIMI is one of the most effective ways to increase trust, visibility, and open rates for your transactional and marketing emails. This guide explains everything you need to know from DNS setup to logo requirements and verification so you can earn that verified checkmark for your brand.What Is BIMI?BIMI is an email authentication standard that allows brands to display their official logo next to their emails in recipients’ inboxes.It builds on top of DMARC, SPF, and DKIM, ensuring that only legitimate senders can use a company’s logo.In short:SPF verifies the sending IP address.DKIM verifies that the message content has not been tampered with.DMARC enforces alignment and policy.BIMI adds a visual trust layer using your brand logo.Why BIMI MattersBoosts Trust: The verified logo signals authenticity and reduces phishing risk.Increases Open Rates: Emails with visible brand logos stand out in crowded inboxes.Enhances Brand Recognition: Your logo appears alongside your sender name across supported email clients.Supports Deliverability: BIMI indirectly improves domain reputation through strong authentication.Email Clients That Support BIMIBIMI is still growing in adoption but is already supported by major inbox providers.Currently supported by:Gmail (requires a Verified Mark Certificate)Yahoo MailApple Mail (macOS and iOS 16 and above)FastmailAOL MailStep-by-Step Guide to Getting the Verified Checkmark with BIMIThere are four main steps to implement BIMI correctly:Set up email authenticationCreate and host your logo in the right formatObtain a Verified Mark Certificate (VMC)Publish your BIMI DNS recordLet’s go through each step in detail.Step 1: Set Up Email Authentication (SPF, DKIM, and DMARC)BIMI works only if your email domain passes all authentication checks.1. Configure SPFSPF (Sender Policy Framework) ensures that only your authorized servers can send emails on behalf of your domain.Example DNS TXT record:v=spf1 include:autosend.com -all
Replace autosend.com with your actual email service provider’s sending domain.2. Configure DKIMDKIM (DomainKeys Identified Mail) adds a digital signature to your emails.Example DKIM DNS record:v=DKIM1; k=rsa; p=MIIBIjANBgkqhk...
Your ESP (like AutoSend) provides this key.Add it to your DNS as a TXT record (usually under a selector like default._domainkey.yourdomain.com).3. Configure DMARCDMARC enforces alignment between SPF and DKIM. It also tells receiving servers what to do when emails fail authentication.Example DMARC DNS record:v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain.com; sp=none; adkim=s; aspf=s
Make sure your policy (p=) is set to quarantine or reject. BIMI will not work if your DMARC policy is set to none.Step 2: Create and Host a BIMI-Compatible LogoYour logo must meet BIMI’s strict visual and technical requirements.Logo Requirements:Format: SVG Tiny Portable/Secure (SVG-P/S)Shape: Square (1:1 aspect ratio)No text or taglinesTransparent backgroundFile size: Under 32 KBIf your logo is not in SVG Tiny PS format, you can convert it using Adobe Illustrator or online tools like the BIMI Logo Generator.Example file name:https://yourdomain.com/logo.svg
Host this logo on an HTTPS-secured URL without redirects.Step 3: Obtain a Verified Mark Certificate (VMC)To show a verified checkmark (especially in Gmail), you will need a VMC, a digital certificate proving that your organization owns the logo and trademark.How to get a VMC:Register your logo as a trademark with an official authority such as USPTO or EUIPO. This is required before applying for a VMC.Buy a VMC from a trusted certificate authority:EntrustDigiCertProvide your trademark details, logo file, and proof of domain control during verification.The verification process usually takes 5 to 15 business days. Once approved, you will receive a .pem file that links your domain to your verified brand logo.Step 4: Publish the BIMI DNS RecordAfter you have your logo and VMC, publish your BIMI record in DNS.Example TXT record:default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem"
Explanation:v=BIMI1 → versionl= → location of your logoa= → location of your VMC fileNote: The a= tag is optional for non-VMC implementations, but Gmail requires it for the verified checkmark.Step 5: Test Your BIMI SetupYou can verify your BIMI configuration with these tools:BIMI InspectorValimail BIMI CheckerMXToolbox BIMI LookupThese tools check:DNS record syntaxSVG formatVMC validityDMARC enforcementOnce everything passes, your verified logo should appear in Gmail and other supported inboxes within a few days.Troubleshooting Common BIMI IssuesProblem Cause Solution Logo not showing: Cause: DMARC policy set to none Solution: Change it to quarantine or reject “No VMC found” error Cause: Missing or invalid a= tag Solution: Add the correct VMC file URL Incorrect logo sizeCause: SVG not compliantSolution: Use SVG Tiny PS format No HTTPSCause: Insecure logo hostingSolution: Host logo and VMC over HTTPSHow Long Does It Take to Show?Once your BIMI record is published, it can take up to 7 days for mailbox providers to pick up and display the logo. Gmail may take a few extra days to cache the verification.The Business Value of BIMIImplementing BIMI is not just a technical task. It is a brand-building investment.Higher engagement: Users are more likely to open verified emails.Reduced phishing risk: Impersonators cannot spoof your brand easily.Consistent branding: Your logo is visible across inboxes, reinforcing recognition.Improved deliverability: Providers trust domains that use BIMI.TL;DRTo get a verified checkmark in Gmail and other inboxes:Set up SPF, DKIM, and DMARC with strict enforcement.Create a square SVG Tiny PS logo and host it securely on HTTPS.Register your logo as a trademark and obtain a Verified Mark Certificate (VMC).Publish a BIMI DNS TXT record linking your logo and VMC.Test and wait a few days for propagation.BIMI is becoming the modern trust signal for email, similar to the verified badge on social networks.By implementing it, you not only protect your brand but also show customers that you care about authenticity and security.If you are using AutoSend, BIMI setup is straightforward. AutoSend fully supports SPF, DKIM, and DMARC alignment, making it simple to authenticate and verify your domain.Frequently Asked Questions (FAQ)1. Does BIMI improve deliverability?Indirectly, yes. BIMI itself does not guarantee better inbox placement, but it relies on strong authentication. That improved trust and alignment positively impact your domain reputation and overall deliverability.2. How much does a Verified Mark Certificate (VMC) cost?A VMC usually costs between $900 and $1,500 per year, depending on the certificate authority. Some providers offer discounts for multi-year subscriptions.3. Can startups use BIMI without a trademark?Not if you want the verified checkmark in Gmail. Gmail requires a VMC, and a VMC requires a registered trademark. However, you can still implement BIMI without a VMC to display your logo in clients that support it without verification (such as Yahoo Mail).4. How long does it take to get verified after publishing BIMI?After publishing your BIMI DNS record and passing authentication checks, it usually takes 3 to 7 days for the logo and verified checkmark to appear in supported inboxes.5. What happens if my DMARC policy is set to “none”?BIMI will not activate. You must change your DMARC policy to quarantine or reject for BIMI to work.6. Do I need a separate BIMI record for subdomains?Yes, if you send emails from multiple subdomains, each subdomain should have its own BIMI record and logo configuration.7. Is BIMI supported in Outlook or Microsoft 365?Not yet. Microsoft has not implemented BIMI as of now, but it may support it in the future as adoption grows.

Learn how to set up BIMI to display your verified logo and checkmark in Gmail to boost trust and email deliverability.

How to Get a Verified Checkmark in Gmail with BIMI

When you start using AutoSend to send <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/transactional-emails">transactional emails</a>, you’re likely using a freshly connected domain or subdomain. That domain might be perfectly configured with verified DNS, working SPF, DKIM, and DMARC. But to mailbox providers like Gmail or Outlook, it’s brand new. They don’t yet know your sending behavior or your engagement quality.If you start sending thousands of password resets or verification emails right away, filters may flag your messages as suspicious. This is where domain warm-up comes in.<h2>What is domain warm-up?</h2>Domain warm-up is the process of gradually increasing the volume of emails you send through a new domain or IP.The goal is to show mailbox providers that you’re a legitimate sender who sends to real, engaged users and not a spammer blasting to thousands of unverified addresses.Think of it like training mode for your domain. Every email you send builds reputation, and with each positive signal (like opens, clicks, or successful deliveries), your domain earns trust.<h2>Why warm-up matters when you start using AutoSend</h2>When you connect a new domain in AutoSend, the system authenticates it automatically with <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/spf-sender-policy-framework">SPF</a>, <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dkim-domainkeys-identified-mail">DKIM</a>, and <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dmarc-domain-based-message-authentication-reporting-conformance">DMARC</a> settings. Technically, you’re ready to send.But reputation is not built overnight. Without a warm-up phase:<ul><li>Your first few campaigns might land in spam or promotions tabs.</li><li>You could experience slow delivery or throttling by major inboxes.</li><li>Your sender reputation could drop before it even starts.</li></ul>Warming up allows AutoSend’s sending infrastructure and your domain to build a positive reputation together. It’s how you establish consistent inbox placement from day one.<h2>Before you start warming up</h2>Make sure these basics are covered before sending your first email:1. Use a dedicated subdomain for transactional emails Instead of sending from your root domain, use something like <code>notify.yourdomain.com</code>. This separates transactional emails from marketing traffic and keeps your main domain reputation safe.2. Verify your domain in AutoSend Go to your AutoSend dashboard and complete domain verification. This ensures your SPF and DKIM records are valid and the domain is ready for sending.3. Send only to real users If you already have active customers or verified users, start with them. Don’t test with random or inactive addresses. High bounces in the first week can severely hurt your reputation.<h2>Step-by-step warm-up plan for AutoSend users</h2><h3>Week 1: Start small and consistent</h3>Send around 20 to 50 transactional emails per day. Examples: sign-up confirmations, test password resets, or account alerts.AutoSend will automatically log each email’s delivery, bounce, and open rate. Keep an eye on these metrics from your dashboard.<h3>Week 2: Slowly increase the volume</h3>If your first week looks healthy (no major bounces or spam complaints), double your daily sending volume. Maintain the same schedule. Sending consistently every day is more important than sending large batches.<h3>Week 3–4: Ramp up to normal usage</h3>You can now start sending more real transactional traffic. Increase gradually by 25–30 percent every few days. Watch your logs in AutoSend; if you notice rising bounce or delay rates, hold the volume steady until things stabilize.<h3>After a month: Reach steady state</h3>Once you’ve reached your normal email volume and maintain stable deliverability, your domain is officially “warmed up.” From here on, consistent performance and low bounce rates will keep your reputation strong.<h2>What AutoSend tracks to help during warm-up</h2>AutoSend provides detailed logs and metrics that are essential during warm-up:<ul><li>Delivery rate – How many emails successfully reach the inbox.</li><li>Bounce reports – Identify invalid addresses early.</li><li>Latency – How fast messages are accepted by recipient servers.</li><li>Spam or complaint signals – See if users flag your messages.</li></ul>You can access all these insights directly in your AutoSend dashboard.<h2>Common mistakes to avoid</h2><ul><li>Sending too much, too soon: The most common mistake is sending large volumes right after connecting your domain to AutoSend. When a brand-new domain suddenly starts sending thousands of emails, mailbox providers interpret that as suspicious behavior. It resembles what spammers do — appear out of nowhere and flood inboxes. Start small, send consistently, and increase volume gradually. This signals stability and helps mailbox algorithms learn to trust your sending pattern.</li><li>Testing with fake or inactive email addresses: It might be tempting to bulk-test your setup using random or made-up addresses, but that’s a fast way to ruin your domain’s reputation. Every bounce or invalid recipient negatively affects your trust score. Instead, test with verified accounts — your own team, colleagues, or users who actually exist. In AutoSend, you can track every delivery and bounce in your logs, so you don’t need to risk fake tests.</li><li>Ignoring soft bounces and temporary errors: Soft bounces often get dismissed as “minor” issues, but they’re valuable signals. They usually indicate that the receiving server is temporarily limiting your volume or delaying acceptance until it trusts you more. If you keep pushing the same volume without addressing it, providers may start blocking you completely. Watch for patterns in your AutoSend delivery logs. If you see repeated soft bounces, slow your sending rate or pause the ramp-up until things stabilize.</li><li>Mixing marketing and transactional messages: During warm-up, focus only on true transactional emails — password resets, account verifications, or receipts. Mixing promotional content like discounts or product updates confuses spam filters and can damage your domain’s reputation before it’s even established. Always send marketing campaigns from a separate subdomain, for example, <code>updates.yourdomain.com</code>, while keeping transactional traffic on <code>notifications.yourdomain.com</code>. AutoSend supports multiple verified domains and subdomains, making this easy to manage.</li><li>Not checking AutoSend logs or monitoring metrics: One of the biggest advantages of AutoSend is visibility — you can see exactly what’s happening with every message you send. Ignoring this data during warm-up is like flying blind. Your logs show delivery success, bounces, latency, and user engagement. Checking them regularly helps you identify potential issues early. If you notice unusual delays, high bounces, or authentication errors, it’s a sign to pause and correct the setup before scaling further.</li><li>Stopping activity too soon: Some users complete their warm-up successfully and then stop sending emails for several weeks. That can actually cause your domain reputation to cool down again. Mailbox providers value consistent patterns, so when you stop sending, your “trust history” begins to fade. If you anticipate downtime, keep a minimal amount of activity running — even a few test emails every few days through AutoSend is enough to maintain domain freshness.</li></ul><h2>How long should warm-up take?</h2>For most AutoSend users, it takes around 2 to 3 weeks to reach full volume safely. Smaller teams or products with lower email traffic can complete it in less time. If your monthly sending volume is less than 10,000 emails then it should be 1 to 2 weeks.The key is not speed but consistency. A slow and steady ramp-up gives mailbox providers the confidence they need to treat your messages as trusted communication.<h2>Maintaining your sender reputation</h2>Once your domain is fully warmed up:<ul><li>Keep sending regularly — inactivity can reset reputation.</li><li>Monitor your <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/bounce-rate">bounce rate</a> weekly.</li><li>Use AutoSend’s logs to ensure your authentication remains valid.</li><li>Avoid sudden spikes in email volume.</li></ul>Treat your domain’s reputation like uptime monitoring. It’s ongoing maintenance, not a one-time task.<hr>Warming up your domain is one of the most important things you can do when starting out with AutoSend or any other <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/email-service-provider-esp">email service provider</a>.It’s not complicated, just intentional. Start small, be consistent, and use the detailed logs AutoSend provides to monitor every stage. Within a few weeks, your emails will reach inboxes faster, avoid spam filters, and stay reliable — exactly what transactional emails are meant to do.You’ve read this far, so here’s a quick tip: encourage users to reply to your emails to boost your domain reputation.<hr><h2>Frequently Asked Questions</h2><h3>Do I need to warm up my domain after connecting it to AutoSend?</h3>Yes. Even if your domain is verified in AutoSend, mailbox providers don’t yet trust it. Warming up builds a positive reputation and prevents your emails from being flagged or delayed.<hr><h3>2. How long should I warm up before sending full volume?</h3>It usually takes around 3 to 4 weeks for most AutoSend users to reach steady-state volume. The exact time depends on your daily email traffic and engagement rates.<hr><h3>3. Should I use my main domain or a subdomain for transactional emails?</h3>Use a subdomain like <code>notifications.yourdomain.com</code>. AutoSend makes this easy to configure during domain setup. It isolates your transactional traffic from marketing or newsletter emails.<hr><h3>4. How can I monitor my progress during warm-up?</h3>Your AutoSend dashboard shows real-time logs for every email: delivery status, bounces, latency, and engagement metrics. You can use this data to track how your warm-up is progressing and adjust accordingly.<hr><h3>5. What happens if I send too many emails too quickly?</h3>Mailbox providers may throttle or block your messages, causing slow delivery or spam placement. It can also lower your domain reputation, making recovery harder later.<hr><h3>6. Can I warm up multiple domains in AutoSend?</h3>Yes. If you manage multiple products or environments, you can verify and warm up separate subdomains individually inside your AutoSend account. Each one will build its own reputation.<hr><h3>7. What if I stop sending emails for a few weeks after warming up?</h3>If your domain goes inactive for a long time, reputation may start to decay. When you resume, repeat a shorter warm-up phase by sending smaller volumes again for a few days.

When you start using AutoSend to send transactional emails, you’re likely using a freshly connected domain or subdomain. That domain might be perfectly configured with verified DNS, working SPF, DKIM, and DMARC. But to mailbox providers like Gmail or Outlook, it’s brand new. They don’t yet know your sending behavior or your engagement quality.If you start sending thousands of password resets or verification emails right away, filters may flag your messages as suspicious. This is where domain warm-up comes in.What is domain warm-up?Domain warm-up is the process of gradually increasing the volume of emails you send through a new domain or IP.The goal is to show mailbox providers that you’re a legitimate sender who sends to real, engaged users and not a spammer blasting to thousands of unverified addresses.Think of it like training mode for your domain. Every email you send builds reputation, and with each positive signal (like opens, clicks, or successful deliveries), your domain earns trust.Why warm-up matters when you start using AutoSendWhen you connect a new domain in AutoSend, the system authenticates it automatically with SPF, DKIM, and DMARC settings. Technically, you’re ready to send.But reputation is not built overnight. Without a warm-up phase:Your first few campaigns might land in spam or promotions tabs.You could experience slow delivery or throttling by major inboxes.Your sender reputation could drop before it even starts.Warming up allows AutoSend’s sending infrastructure and your domain to build a positive reputation together. It’s how you establish consistent inbox placement from day one.Before you start warming upMake sure these basics are covered before sending your first email:1. Use a dedicated subdomain for transactional emailsInstead of sending from your root domain, use something like notify.yourdomain.com. This separates transactional emails from marketing traffic and keeps your main domain reputation safe.2. Verify your domain in AutoSendGo to your AutoSend dashboard and complete domain verification. This ensures your SPF and DKIM records are valid and the domain is ready for sending.3. Send only to real usersIf you already have active customers or verified users, start with them. Don’t test with random or inactive addresses. High bounces in the first week can severely hurt your reputation.Step-by-step warm-up plan for AutoSend usersWeek 1: Start small and consistentSend around 20 to 50 transactional emails per day.Examples: sign-up confirmations, test password resets, or account alerts.AutoSend will automatically log each email’s delivery, bounce, and open rate. Keep an eye on these metrics from your dashboard.Week 2: Slowly increase the volumeIf your first week looks healthy (no major bounces or spam complaints), double your daily sending volume. Maintain the same schedule. Sending consistently every day is more important than sending large batches.Week 3–4: Ramp up to normal usageYou can now start sending more real transactional traffic.Increase gradually by 25–30 percent every few days. Watch your logs in AutoSend; if you notice rising bounce or delay rates, hold the volume steady until things stabilize.After a month: Reach steady stateOnce you’ve reached your normal email volume and maintain stable deliverability, your domain is officially “warmed up.” From here on, consistent performance and low bounce rates will keep your reputation strong.What AutoSend tracks to help during warm-upAutoSend provides detailed logs and metrics that are essential during warm-up:Delivery rate – How many emails successfully reach the inbox.Bounce reports – Identify invalid addresses early.Latency – How fast messages are accepted by recipient servers.Spam or complaint signals – See if users flag your messages.You can access all these insights directly in your AutoSend dashboard.Common mistakes to avoidSending too much, too soon: The most common mistake is sending large volumes right after connecting your domain to AutoSend. When a brand-new domain suddenly starts sending thousands of emails, mailbox providers interpret that as suspicious behavior. It resembles what spammers do — appear out of nowhere and flood inboxes. Start small, send consistently, and increase volume gradually. This signals stability and helps mailbox algorithms learn to trust your sending pattern.Testing with fake or inactive email addresses: It might be tempting to bulk-test your setup using random or made-up addresses, but that’s a fast way to ruin your domain’s reputation. Every bounce or invalid recipient negatively affects your trust score. Instead, test with verified accounts — your own team, colleagues, or users who actually exist. In AutoSend, you can track every delivery and bounce in your logs, so you don’t need to risk fake tests.Ignoring soft bounces and temporary errors: Soft bounces often get dismissed as “minor” issues, but they’re valuable signals. They usually indicate that the receiving server is temporarily limiting your volume or delaying acceptance until it trusts you more. If you keep pushing the same volume without addressing it, providers may start blocking you completely. Watch for patterns in your AutoSend delivery logs. If you see repeated soft bounces, slow your sending rate or pause the ramp-up until things stabilize.Mixing marketing and transactional messages: During warm-up, focus only on true transactional emails — password resets, account verifications, or receipts. Mixing promotional content like discounts or product updates confuses spam filters and can damage your domain’s reputation before it’s even established. Always send marketing campaigns from a separate subdomain, for example, updates.yourdomain.com, while keeping transactional traffic on notifications.yourdomain.com. AutoSend supports multiple verified domains and subdomains, making this easy to manage.Not checking AutoSend logs or monitoring metrics: One of the biggest advantages of AutoSend is visibility — you can see exactly what’s happening with every message you send. Ignoring this data during warm-up is like flying blind. Your logs show delivery success, bounces, latency, and user engagement. Checking them regularly helps you identify potential issues early. If you notice unusual delays, high bounces, or authentication errors, it’s a sign to pause and correct the setup before scaling further.Stopping activity too soon: Some users complete their warm-up successfully and then stop sending emails for several weeks. That can actually cause your domain reputation to cool down again. Mailbox providers value consistent patterns, so when you stop sending, your “trust history” begins to fade. If you anticipate downtime, keep a minimal amount of activity running — even a few test emails every few days through AutoSend is enough to maintain domain freshness.How long should warm-up take?For most AutoSend users, it takes around 2 to 3 weeks to reach full volume safely. Smaller teams or products with lower email traffic can complete it in less time. If your monthly sending volume is less than 10,000 emails then it should be 1 to 2 weeks.The key is not speed but consistency. A slow and steady ramp-up gives mailbox providers the confidence they need to treat your messages as trusted communication.Maintaining your sender reputationOnce your domain is fully warmed up:Keep sending regularly — inactivity can reset reputation.Monitor your bounce rate weekly.Use AutoSend’s logs to ensure your authentication remains valid.Avoid sudden spikes in email volume.Treat your domain’s reputation like uptime monitoring. It’s ongoing maintenance, not a one-time task.Warming up your domain is one of the most important things you can do when starting out with AutoSend or any other email service provider.It’s not complicated, just intentional. Start small, be consistent, and use the detailed logs AutoSend provides to monitor every stage. Within a few weeks, your emails will reach inboxes faster, avoid spam filters, and stay reliable — exactly what transactional emails are meant to do.You’ve read this far, so here’s a quick tip: encourage users to reply to your emails to boost your domain reputation.Frequently Asked QuestionsDo I need to warm up my domain after connecting it to AutoSend?Yes. Even if your domain is verified in AutoSend, mailbox providers don’t yet trust it. Warming up builds a positive reputation and prevents your emails from being flagged or delayed.2. How long should I warm up before sending full volume?It usually takes around 3 to 4 weeks for most AutoSend users to reach steady-state volume. The exact time depends on your daily email traffic and engagement rates.3. Should I use my main domain or a subdomain for transactional emails?Use a subdomain like notifications.yourdomain.com. AutoSend makes this easy to configure during domain setup. It isolates your transactional traffic from marketing or newsletter emails.4. How can I monitor my progress during warm-up?Your AutoSend dashboard shows real-time logs for every email: delivery status, bounces, latency, and engagement metrics. You can use this data to track how your warm-up is progressing and adjust accordingly.5. What happens if I send too many emails too quickly?Mailbox providers may throttle or block your messages, causing slow delivery or spam placement. It can also lower your domain reputation, making recovery harder later.6. Can I warm up multiple domains in AutoSend?Yes. If you manage multiple products or environments, you can verify and warm up separate subdomains individually inside your AutoSend account. Each one will build its own reputation.7. What if I stop sending emails for a few weeks after warming up?If your domain goes inactive for a long time, reputation may start to decay. When you resume, repeat a shorter warm-up phase by sending smaller volumes again for a few days.

Learn how to warm up a new domain for transactional emails with this step-by-step guide. Improve deliverability, build reputation, and avoid spam filters.

How to Warm Up a New Domain for Transactional Emails

You build a great product, craft a thoughtful message, hit send... and then your user says, “I didn’t get the email.” So you check your logs, everything looks fine, but the message is sitting quietly in their spam folder. Oops, embarrassing!This is one of the most frustrating parts of running an app or sending transactional emails. The good news? It’s almost always fixable once you understand what’s going wrong.Let’s unpack why emails go to spam and how you can keep yours landing safely in the inbox.<h2>You haven’t set up proper email authentication</h2>This is the number one reason your emails end up in spam.If your domain isn’t authenticated, email providers like Gmail or Outlook can’t confirm the message is really coming from you. So, to protect users, they flag it as suspicious.Set up three essential DNS records:<ul><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/spf-sender-policy-framework">SPF</a> – lists the servers allowed to send emails for your domain.</li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dkim-domainkeys-identified-mail">DKIM</a> – adds a digital signature to prove the email wasn’t modified.</li><li><a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://autosend.com/glossary/dmarc-domain-based-message-authentication-reporting-conformance">DMARC</a> – tells providers what to do when an email fails SPF or DKIM checks.</li></ul>Once you configure these correctly, you’ll see a noticeable improvement in inbox placement. Tools like <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://www.mail-tester.com/">Mail-Tester</a>, <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://mxtoolbox.com/">MXToolbox</a>, or <a target="_blank" rel="noopener noreferrer" class="break-all link-break text-gray-500 hover:underline" href="https://dmarcian.com/">DMARCian</a> can help verify your setup.<h2>Your sending domain or IP has a poor reputation</h2>Every domain and IP has a reputation score that mailbox providers use to decide where your emails go. If too many of your messages get flagged, bounced, or ignored, your reputation drops, and your next emails are more likely to be filtered as spam.Common causes include:<ul><li>Sending large batches too quickly</li><li>Using shared IPs with other senders who spam</li><li>Getting high bounce or complaint rates</li></ul>To fix this:<ul><li>Warm up new domains gradually instead of blasting thousands of emails on day one.</li><li>Use dedicated IPs if you send high volume.</li><li>Keep your bounce rate below 2% and complaint rate below 0.1%.</li></ul>Think of your sender reputation like a credit score. Consistency, trust, and history matter more than speed.<h2>Your email content looks spammy</h2>Spam filters scan the content of your emails before they reach the inbox. Even if your authentication is perfect, your copy and formatting can still trigger a filter.Here’s what to watch out for:<ul><li>Overuse of “FREE,” “LIMITED TIME,” or “CLICK NOW.”</li><li>Too many images with little text.</li><li>Broken HTML or messy inline styles.</li><li>No plain text version of the email.</li><li>Missing unsubscribe link in marketing emails.</li></ul>Keep your design simple and your tone natural. Write like you’re talking to a person, not pitching a crowd. Always include a clear sender name, recognizable address, and valid contact info.Pro tip: Before sending a campaign, run it through a spam-check tool to see how filters interpret your content.<h2>You’re sending from a new or cold domain</h2>If your domain is brand new or has never sent emails before, providers don’t trust it yet. That’s normal.Start slow. Send small batches to verified or internal addresses, build up a positive history, and monitor engagement. This process is known as domain warming.You can also use a subdomain for your email traffic, like <code>mail.yourdomain.com</code> or <code>notifications.yourdomain.com</code>. This keeps your main domain safe if something goes wrong.Remember, reputation builds over time. The key is steady, consistent sending behavior.<h2>You’re not monitoring your delivery performance</h2>Email deliverability isn’t a one-time setup. It’s something you have to monitor continuously.Keep an eye on:<ul><li>Bounce logs: Which addresses are failing and why.</li><li>Open and click rates: Low engagement signals filters that your emails aren’t wanted.</li><li>Spam complaints: Even a small spike can affect your reputation.</li></ul>Most modern email platforms provide dashboards or webhook logs for this data. Reviewing them weekly helps you spot patterns before they become serious problems.If you’re sending through APIs or services like AutoSend, you can use Email Activity feature to track your delivery rate and fix authentication or content issues fast.<h2>You’re mixing transactional and promotional content</h2>This is an easy mistake to make. Transactional emails are system messages triggered by user actions (signup confirmations, password resets, invoices). Promotional emails are sent to promote something (updates, offers, new features).Mixing them confuses both users and spam filters. For example:<blockquote>“Your password has been reset successfully. Here’s a 30% discount on your next order.”</blockquote>That’s not a transactional email anymore. Keep them separate. Use different templates, sender names, or subdomains for each type.This clarity helps you stay compliant with laws like CAN-SPAM and improves overall inbox placement.<h2>You’re sending without user consent</h2>Even if you have the best infrastructure, sending emails to people who didn’t opt in is a fast track to the spam folder.Always collect consent before sending marketing messages. Use double opt-in where users confirm their subscription. Make it easy to unsubscribe or change preferences at any time.Trust is a long-term deliverability strategy. The fewer complaints you get, the stronger your domain reputation becomes.<h2>Test before you send</h2>Before sending anything to your full list, send test emails to a few different accounts (Gmail, Outlook, Yahoo) and check where they land.If they consistently show up in spam, inspect the headers and test against spam score tools. Small tweaks in authentication, copy, or formatting can often make the difference.<hr>Landing in the spam folder doesn’t mean your emails are doomed. It’s usually a sign that one or two technical or behavioral factors need attention.Start with authentication, check your domain reputation, simplify your content, and watch your logs. Over time, your inbox placement will improve and stay consistent.Good deliverability is not luck. It’s the result of clean setup, good habits, and trust built over time.

You build a great product, craft a thoughtful message, hit send... and then your user says, “I didn’t get the email.” So you check your logs, everything looks fine, but the message is sitting quietly in their spam folder. Oops, embarrassing!This is one of the most frustrating parts of running an app or sending transactional emails. The good news? It’s almost always fixable once you understand what’s going wrong.Let’s unpack why emails go to spam and how you can keep yours landing safely in the inbox.You haven’t set up proper email authenticationThis is the number one reason your emails end up in spam.If your domain isn’t authenticated, email providers like Gmail or Outlook can’t confirm the message is really coming from you. So, to protect users, they flag it as suspicious.Set up three essential DNS records:SPF – lists the servers allowed to send emails for your domain.DKIM – adds a digital signature to prove the email wasn’t modified.DMARC – tells providers what to do when an email fails SPF or DKIM checks.Once you configure these correctly, you’ll see a noticeable improvement in inbox placement. Tools like Mail-Tester, MXToolbox, or DMARCian can help verify your setup.Your sending domain or IP has a poor reputationEvery domain and IP has a reputation score that mailbox providers use to decide where your emails go. If too many of your messages get flagged, bounced, or ignored, your reputation drops, and your next emails are more likely to be filtered as spam.Common causes include:Sending large batches too quicklyUsing shared IPs with other senders who spamGetting high bounce or complaint ratesTo fix this:Warm up new domains gradually instead of blasting thousands of emails on day one.Use dedicated IPs if you send high volume.Keep your bounce rate below 2% and complaint rate below 0.1%.Think of your sender reputation like a credit score. Consistency, trust, and history matter more than speed.Your email content looks spammySpam filters scan the content of your emails before they reach the inbox. Even if your authentication is perfect, your copy and formatting can still trigger a filter.Here’s what to watch out for:Overuse of “FREE,” “LIMITED TIME,” or “CLICK NOW.”Too many images with little text.Broken HTML or messy inline styles.No plain text version of the email.Missing unsubscribe link in marketing emails.Keep your design simple and your tone natural. Write like you’re talking to a person, not pitching a crowd. Always include a clear sender name, recognizable address, and valid contact info.Pro tip: Before sending a campaign, run it through a spam-check tool to see how filters interpret your content.You’re sending from a new or cold domainIf your domain is brand new or has never sent emails before, providers don’t trust it yet. That’s normal.Start slow. Send small batches to verified or internal addresses, build up a positive history, and monitor engagement. This process is known as domain warming.You can also use a subdomain for your email traffic, like mail.yourdomain.com or notifications.yourdomain.com. This keeps your main domain safe if something goes wrong.Remember, reputation builds over time. The key is steady, consistent sending behavior.You’re not monitoring your delivery performanceEmail deliverability isn’t a one-time setup. It’s something you have to monitor continuously.Keep an eye on:Bounce logs: Which addresses are failing and why.Open and click rates: Low engagement signals filters that your emails aren’t wanted.Spam complaints: Even a small spike can affect your reputation.Most modern email platforms provide dashboards or webhook logs for this data. Reviewing them weekly helps you spot patterns before they become serious problems.If you’re sending through APIs or services like AutoSend, you can use Email Activity feature to track your delivery rate and fix authentication or content issues fast.You’re mixing transactional and promotional contentThis is an easy mistake to make. Transactional emails are system messages triggered by user actions (signup confirmations, password resets, invoices). Promotional emails are sent to promote something (updates, offers, new features).Mixing them confuses both users and spam filters. For example:“Your password has been reset successfully. Here’s a 30% discount on your next order.”That’s not a transactional email anymore. Keep them separate. Use different templates, sender names, or subdomains for each type.This clarity helps you stay compliant with laws like CAN-SPAM and improves overall inbox placement.You’re sending without user consentEven if you have the best infrastructure, sending emails to people who didn’t opt in is a fast track to the spam folder.Always collect consent before sending marketing messages. Use double opt-in where users confirm their subscription. Make it easy to unsubscribe or change preferences at any time.Trust is a long-term deliverability strategy. The fewer complaints you get, the stronger your domain reputation becomes.Test before you sendBefore sending anything to your full list, send test emails to a few different accounts (Gmail, Outlook, Yahoo) and check where they land.If they consistently show up in spam, inspect the headers and test against spam score tools. Small tweaks in authentication, copy, or formatting can often make the difference.Landing in the spam folder doesn’t mean your emails are doomed. It’s usually a sign that one or two technical or behavioral factors need attention.Start with authentication, check your domain reputation, simplify your content, and watch your logs. Over time, your inbox placement will improve and stay consistent.Good deliverability is not luck. It’s the result of clean setup, good habits, and trust built over time.

The email blog

Stories, strategies, and insights for sending better emails.