SPF, DKIM and DMARC for WordPress sites: why your emails land in spam

Updated 2026-10-16 · 8 min read · by the IsHacked team

"The contact form doesn't work" usually means it works fine and the email lands in spam. Since 2024, Gmail and Yahoo require senders to authenticate their mail, and a domain without correct SPF, DKIM and DMARC records struggles to reach the inbox.

Check your domain's SPF, DKIM and DMARC

The three records in one minute

• SPF lists the servers allowed to send mail for your domain. It is one TXT record on the domain: v=spf1 include:_spf.google.com ~all.
• DKIM signs each message with a key published in DNS under a selector, for example google._domainkey.example.com.
• DMARC tells receivers what to do when SPF and DKIM don't line up with the From address, and where to send reports: a TXT record at _dmarc.example.com.

SPF mistakes we see most

Two SPF records

Adding a new email service often means someone adds a second v=spf1 record instead of editing the first. Receivers then fail SPF for everything. Merge them:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

More than 10 DNS lookups

Each include:, a, mx, ptr and exists costs a lookup, including the ones inside each include. Hosting providers' includes are often nested several levels deep. At 11 lookups SPF breaks. Remove services you no longer use, and drop a and mx if those servers don't send mail.

The mailbox provider is missing

If your MX records point to Google Workspace, your SPF needs include:_spf.google.com. For Microsoft 365 it is include:spf.protection.outlook.com. Without it, mail sent from those mailboxes can fail SPF.

+all

+all authorises every server on the internet. Use ~all (soft fail) or -all (fail).

DKIM: turn it on at the provider

DKIM is not on by default everywhere. In Google Workspace, go to Apps → Google Workspace → Gmail → Authenticate email, generate the key and publish it as google._domainkey, then click Start authentication. Microsoft 365 uses two CNAME records, selector1._domainkey and selector2._domainkey. Transactional services (Amazon SES, Mailgun, Postmark, SendGrid) give you their own records to publish.

DMARC: start with reports, then enforce

_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Watch the reports for a few weeks, fix any legitimate sender that fails, then move to p=quarantine and finally p=reject. A domain that never sends email should publish v=spf1 -all and p=reject so nobody can send as it.

WordPress specifics

• Don't send through PHP mail(). Mail from the web server rarely passes SPF or DKIM. Use an SMTP or API plugin connected to your mailbox provider or a transactional service.
• Use your own domain in From. Contact forms that set the visitor's address as From fail DMARC. Send from noreply@yourdomain and put the visitor in Reply-To.
• Watch the blocklists. A hacked site sending spam gets its domain and server IP listed, and then even legitimate mail bounces.

FAQ

Can I have two SPF records?

No. A domain must publish exactly one SPF record. Two records make SPF fail with a permanent error for all mail. Merge them into one record with all the includes.

What does "too many DNS lookups" mean for SPF?

Every include, a, mx, ptr and exists mechanism costs one DNS lookup, and nested includes count too. Past 10 lookups receivers fail SPF. Remove unused includes or replace them with fewer, broader ones.

Is DMARC p=none enough?

It is the right first step: it gives you reports without affecting delivery. But it doesn't stop anyone from spoofing your domain. Move to p=quarantine and then p=reject once the reports show only legitimate senders.