How to Prevent Email Spam in 2026: Configure SPF, DKIM and DMARC Correctly

วิธีป้องกัน Email Spam 2026 ตั้งค่า SPF DKIM DMARC ให้ถูกต้อง

Why Emails Land in Spam: The Most Common Root Causes

Emails landing in the spam folder is rarely accidental. Mail servers at major providers — Gmail, Outlook, Yahoo — run sophisticated multi-factor scoring engines before deciding whether to deliver a message to the inbox or the junk folder. Understanding the genuine causes allows you to fix the right thing instead of guessing.

The single most common cause is missing or misconfigured email authentication. SPF, DKIM, and DMARC are industry-standard DNS records that tell receiving mail servers whether a message truly originates from an authorised source. Since Google and Yahoo enforced mandatory Sender Requirements in 2024, domains sending without all three face dramatically higher spam filter rates.

IP reputation problems are the second major culprit. In shared hosting, your IP address is shared with other customers. If any of them sends spam, your IP may be listed on a DNS blocklist (DNSBL) without you knowing. Reputation also drops when you send a large volume of email suddenly without IP warming, or when bounce rates climb because your list contains stale or invalid addresses.

Content scoring works independently of authentication. Even with perfect SPF, DKIM and DMARC, a subject line packed with "FREE!!!", excessive exclamation marks, hidden text, misleading links, or a very high image-to-text ratio will raise the spam score. Finally, low engagement signals — recipients who never open your mail — teach providers to route future messages from your domain directly to spam.

• Missing or broken SPF / DKIM / DMARC records
• IP address on one or more DNS blacklists
• Subject line or body text containing spam-trigger phrases
• High hard bounce rate (invalid addresses)
• Elevated spam complaint rate from recipients
• Sending large volumes without IP warmup
• Using a free email address (e.g., @gmail.com) for business mail

What Is an SPF Record and How to Set It Up

SPF (Sender Policy Framework) is a DNS TXT record that lists every mail server authorised to send email on behalf of your domain. When a recipient's mail server receives a message, it queries the SPF record of the sender's domain and checks whether the sending IP is on the approved list. A pass keeps the message moving; a fail or softfail raises its spam score.

An SPF record opens with v=spf1 followed by one or more mechanisms. include: references the SPF record published by a third-party mail service, ip4: or ip6: authorises a specific address directly, and a or mx approve the domain's A or MX records. The record ends with a qualifier: +all (allow everything — never use this), ~all (softfail — permit but flag), -all (hardfail — reject unapproved senders), or ?all (neutral).

Example SPF record for a domain that sends through both Google Workspace and its own hosting server:

example.com. IN TXT "v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all"

To add this in DirectAdmin: navigate to DNS Management, click Add Record, set the Type to TXT, the Name to @, and paste the SPF value. Set TTL to 3600 initially so changes propagate quickly during testing. Once confirmed, you can raise it to 86400.

Key constraints to respect: a domain must have only one SPF record — multiple TXT records starting with v=spf1 on the same hostname invalidate all of them. Additionally SPF imposes a 10 DNS lookup limit; exceeding it causes a PermError. If you use many third-party senders, use an SPF flattening tool to inline the IPs and stay within the limit.

• Verify your SPF with dig TXT example.com or MXToolbox SPF Checker
• Start with ~all during rollout; switch to -all after confirming all senders are listed
• Update SPF every time you add, change, or remove a mail sending service
• SPF does not protect forwarded mail — combine with DKIM for resilience

How DKIM Works and How to Configure It on Your Hosting

DKIM (DomainKeys Identified Mail) uses asymmetric cryptography to attach a verifiable digital signature to every outgoing message. Unlike SPF, which checks the sending IP, DKIM signs the message content and selected headers with a private key stored on your server. Receiving mail servers retrieve your public key from DNS to verify the signature — if it matches, the message is confirmed authentic and unchanged in transit.

The process in detail: when you send a message, your mail server hashes the chosen headers and body, then encrypts the hash with the private key. The result is embedded in a DKIM-Signature: header. The recipient's server reads the s= (selector) and d= (domain) fields, looks up the public key at <selector>._domainkey.<domain> in DNS, decrypts the hash, and compares it against the actual message. Any alteration in transit causes a mismatch — DKIM Fail.

Example DKIM public key DNS record (add as a TXT record at the selector subdomain):

mail._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3v8xP..."

On DirectAdmin-based hosting: go to E-Mail Manager and look for the DKIM section, or navigate to DNS Management and choose Generate DKIM Key. The system creates a 2048-bit RSA key pair, stores the private key securely, and displays the public key value for you to add to your DNS zone. If your DNS is managed on the same server, it may be added automatically.

A selector is a short label (such as mail, default, s1) that lets you publish multiple DKIM keys simultaneously — useful when you have several sending services, or when rotating keys. Key rotation every 6–12 months is recommended as a security best practice. Use 2048-bit keys at minimum; 4096-bit adds security but can slow verification slightly.

• Test DKIM with dig TXT mail._domainkey.example.com
• Send a test message to mail-tester.com or learndmarc.com for a full pass/fail report
• Each sending service (Google, Mailchimp, SendGrid, etc.) needs its own DKIM selector
• DKIM survives email forwarding better than SPF because the signature travels with the message

What Is DMARC and How It Prevents Email Spoofing

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that ties SPF and DKIM together. It tells receiving mail servers what to do when a message fails both authentication checks — deliver it anyway, send it to spam (quarantine), or reject it outright — and instructs them to send you aggregate and forensic reports so you can see who is sending on behalf of your domain.

DMARC introduces the concept of alignment: the domain in the visible From: header must align with either the SPF-authenticated domain or the DKIM-signed domain (or both). This is what stops email spoofing — even if an attacker crafts an email that passes SPF on a different domain, DMARC will fail because the From address does not align.

A recommended starting DMARC record (monitoring only, no enforcement):

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=r; aspf=r"

A fully enforced DMARC record (maximum protection):

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; adkim=s; aspf=s"

Key parameters: p= sets the policy (none / quarantine / reject). pct= applies the policy to only that percentage of failing messages — start at 10–25% to limit blast radius during rollout. rua= is the address for daily aggregate reports (in XML) showing authentication pass/fail stats by sending source. ruf= receives per-message forensic reports. adkim=r and aspf=r use relaxed alignment (subdomains permitted); change to s for strict alignment once you are confident.

Recommended rollout: spend two to four weeks on p=none analysing aggregate reports to discover any legitimate mail sources not yet covered by SPF and DKIM. Add the missing records, then move to p=quarantine; pct=25, expand the percentage over a week, and finally switch to p=reject for maximum spoofing protection.

DNS Blacklists: How to Check and Request Removal

DNS blacklists (DNSBLs), also called Real-time Blackhole Lists (RBLs), are databases that record IP addresses and domains reported for sending spam. Participating mail servers query these lists in real time before accepting a message. A single listing on a major DNSBL can cause your email to be silently dropped or routed to spam across a large fraction of the internet.

The most influential blacklists to monitor are Spamhaus ZEN (aggregating SBL, XBL, and PBL) — used by the majority of enterprise mail servers worldwide; Barracuda Reputation Block List (BRBL) — embedded in Barracuda appliances used by many businesses; SORBS (Spam and Open Relay Blocking System); SpamCop; and Validity (formerly Return Path) Senderscore, which is not a blocklist but a reputation score from 0–100 that many filters consult.

To check whether your IP or domain is listed: visit MXToolbox Blacklist Check at mxtoolbox.com/blacklists.aspx and enter your IP address or domain. It queries over 100 lists simultaneously and flags any hits within seconds. Alternatively, multirbl.valli.org covers a broader set of less common lists. Check both your server's outbound IP and your domain name.

If you find a listing, the removal process has two mandatory steps. First, you must identify and fix the root cause — a compromised script sending bulk mail, an open SMTP relay, a hacked email account, or a misconfigured server. Without fixing the cause, any delisting will be reversed quickly. Second, submit a delist request to each blocklist via their respective portal: Spamhaus at check.spamhaus.org, Barracuda at barracudacentral.org/lookups, and SORBS at sorbs.net. Processing times vary from hours to several days.

• Schedule a monthly blacklist check, or set up automated monitoring via MXToolbox Monitor
• The Spamhaus PBL lists consumer and dynamically assigned IPs — use a dedicated SMTP relay to send business mail from such addresses
• Some listings expire automatically after 30–90 days of clean behaviour; others require explicit delist requests
• After delisting, monitor closely for the next 30 days to ensure the cause does not recur

Email Content That Triggers Spam Filters

Even with perfect SPF, DKIM, and DMARC, the body of your email goes through a separate content analysis layer. Spam filters like SpamAssassin, Google's Gemini-powered classifier, and Microsoft's proprietary engine each assign a score based on hundreds of signals in the subject line, HTML body, links, and attachments. Knowing what triggers them lets you craft messages that reach the inbox consistently.

Subject line red flags: ALL CAPS words, excessive exclamation marks (!!!), phrases like "FREE", "Win", "Guaranteed", "Act now", "Limited time offer", "No risk", "Click here", "You've been selected", and heavy emoji use all push the score up. A single trigger word rarely causes a fail, but combining several can tip a borderline message into spam.

HTML body issues: An image-to-text ratio above 80% is a major signal, because spammers often embed their message in a graphic to evade text analysis. Hidden text (white text on white background, font size 0), links where the display URL differs from the href target, multiple redirecting short links, broken HTML tags, inline JavaScript (stripped by clients anyway), and loading images from low-reputation external domains all increase spam scores.

Best practice for email content: maintain at least a 60:40 text-to-image ratio; always include a plain-text alternative part alongside your HTML; make sure every marketing email contains a working, single-click unsubscribe link (legally required under CAN-SPAM, GDPR, and Thailand's PDPA); use real domain links rather than URL shorteners; and avoid attaching executable files or macro-enabled Office documents.

• Test your messages at mail-tester.com or GlockApps before sending to your full list
• Send to seed accounts across Gmail, Outlook, and Yahoo to check actual inbox placement
• All links in your email should point to domains with clean reputations
• Never buy email lists — they almost always contain spam traps that will blacklist your IP

Monitoring and Maintaining Email Sender Reputation

Sender reputation is the composite trust score that ISPs and mail providers assign to your sending IP and domain over time. A high reputation means messages skip aggressive filtering and land in the inbox; a low reputation means the opposite. Unlike a DNSBL listing, reputation is a continuous signal built from months of sending behaviour — and damaged reputation can take weeks to recover.

The four metrics that matter most are: Spam complaint rate — the percentage of recipients who click "Report Spam"; keep this below 0.1% (Google flags domains above 0.3% for enforcement). Bounce rate — hard bounces (permanent invalid addresses) should stay under 2%; high bounce rates signal to providers that you are not maintaining your list. Spam trap hits — sending to honeypot addresses that are not real people; this is a severe signal with no easy fix. Engagement rate — opens, clicks, replies, and forwards are positive signals that providers use to route future mail more favourably.

Tools for monitoring reputation: Google Postmaster Tools (postmaster.google.com) is essential for anyone sending to Gmail at scale — it shows domain and IP reputation as a bar (Low / Medium / High / Very High) plus spam rate trends. Microsoft SNDS (sendersupport.olc.protection.outlook.com/snds) provides similar data for Outlook. Validity Senderscore (senderscore.org) gives a 0–100 score consulted by many commercial filters. Cisco Talos Intelligence (talosintelligence.com) shows a Good / Neutral / Poor classification for your IP.

Long-term reputation practices: start new IPs with an IP warmup plan — send to your most engaged subscribers first and increase volume gradually over 4–6 weeks. Practise regular list hygiene by removing hard bounces immediately and suppressing contacts who have not opened any email in 6–12 months. Use double opt-in to confirm subscriber intent and dramatically reduce the chance of spam trap hits. Monitor feedback loops (FBL) from major ISPs to receive near-real-time complaint notifications.

• Use an email validation API at signup to block invalid addresses before they enter your list
• Segment your list by engagement level and reduce sending frequency to inactive segments
• A sunset policy — stopping mail to contacts inactive for 6+ months — protects your IP reputation
• Reply rate is a strong positive signal; encourage recipients to respond to your emails

Choosing Hosting with Strong Anti-Spam Systems

The hosting provider you choose forms the foundation of your entire email infrastructure. A well-chosen host makes setting up SPF, DKIM, and DMARC straightforward, provides clean shared IP addresses, and offers built-in tools to protect outbound and inbound mail. A poorly chosen one can leave you fighting blacklistings and deliverability problems you did not cause.

When evaluating hosting for email reliability, look for these capabilities. Clean shared IP pools: the host must enforce strict no-spam policies across all shared customers. If the company tolerates abuse, every customer on that IP range suffers. Ask how the host handles spam complaints and account terminations. DKIM management in the control panel: you should be able to generate, rotate, and publish DKIM keys without opening a support ticket. DirectAdmin, used by AsiaGB, provides a DKIM section that generates 2048-bit RSA keys and can automatically update the DNS zone if both are on the same server.

SpamAssassin for incoming mail: filtering inbound spam keeps your inbox clean and also reduces the risk of your users accidentally forwarding spam through your server, which can affect outbound reputation. The threshold score and actions (delete / quarantine / tag subject) should be configurable per mailbox. Outbound rate limiting: if a web application on your server is compromised and begins sending bulk mail, rate limits act as a circuit breaker preventing your IP from being blacklisted before you can respond.

Additional features worth checking: dedicated outbound IP options (for high-volume senders), support for MTA-STS and BIMI (newer authentication standards for brand logos in Gmail), reverse DNS (PTR record) matching your mail server's hostname, and transparent abuse handling with published SLAs.

AsiaGB.com is the hosting provider our team recommends for businesses that prioritise email deliverability. It runs SSD storage infrastructure, manages email and DKIM through DirectAdmin, and maintains servers in Thailand and Singapore. Thai-language support is available 24 hours a day, and uptime measured at 99% from our monitoring. The pricing makes it accessible to small businesses and startups while offering the reliability that organisations handling transactional or marketing email require.