Why your firm’s email lands in junk.

What we found.

In one established firm’s setup, staff email was failing those checks.⁠Note 1

1. One firm, not named. The records were merged, signing was turned on, and both were confirmed on public lookups.

The domain published two sender records where only one is allowed, so receiving servers treated the check as failed.⁠Note 2 The staff mailboxes were not signing their mail. And the domain’s own policy told receivers to put mail that failed into junk.

1. The email standard allows a domain one sender record. With more than one, the check returns an error. Source: RFC 7208, sections 3.2 and 4.5, read 26 October 2026.

Nothing looked wrong from inside the office. Messages left; some never arrived where they were meant to.

How to check yours.

1. 01

   On a Windows computer, open Command Prompt, type nslookup -type=txt yourfirm.com and press Enter. Count the lines that begin with v=spf1. There should be exactly one.

2. 02

   Type nslookup -type=txt _dmarc.yourfirm.com. If you see p=quarantine or p=reject, mail that fails the checks goes to junk or is turned away.

3. 03

   Send a message from your work address to a personal Gmail account. Open it, choose Show original from the menu, and look at SPF, DKIM and DMARC. Each should say PASS.

What to do about it.

Merge the sender records into one, turn on signing in your email provider, and only then make the policy stricter. Done in that order, it is usually a short job for whoever runs your email. Done in the wrong order, real mail goes missing.

Who wrote this.

Daniel Levine, Principal. Written on 26 October 2026 and reviewed before publishing.⁠Note 3 Corrections: none.

1. If something here turns out to be wrong, the correction is listed on this page with its date.