Most email goes to spam for one of two reasons: the message looks like spam, or the sender looks like a spammer. The first is a content problem; the second is a DNS problem. This post is about the second one.
There are four DNS records every sender needs. Without all four, even a perfectly-written email from a clean list will get filtered.
What is SPF?
SPF (Sender Policy Framework) is a TXT record that lists the IPs and services allowed to send mail as your domain. Receiving servers check the envelope (MAIL FROM) against this list. SES needs:
v=spf1 include:amazonses.com ~all
The 10-DNS-lookup limit is real. If you nest too many include: directives, the check returns a permanent error and SPF fails outright. Always test with an SPF validator before going live.
What is DKIM?
DKIM (DomainKeys Identified Mail) is a cryptographic signature on every outgoing message. The signing key lives on your sending infrastructure; the public key is published as a DNS record. The receiving server verifies the signature using the public key.
2048-bit keys in 2026. 1024 bits is the floor Gmail still accepts, but shorter keys are increasingly down-ranked and fall out of compliance with several enterprise security policies. SES generates 2048-bit keys by default; rotate them annually.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do when SPF and DKIM both fail. Three policies:
p=none: report only. Don't actually filter anything.p=quarantine: failed messages go to spam.p=reject: failed messages are rejected at the gateway.
Start at p=none and read a couple of weeks of aggregate reports, so you find the legitimate sender you forgot before a policy blocks it. Then move to p=quarantine and don't linger on p=none past that, because spammers spoofing your domain keep getting through under it. Move to p=reject after 30 days at p=quarantine with clean reports.
Why does MAIL FROM matter?
SES sends from a default amazonses.com envelope address unless you configure a custom MAIL FROM. The custom MAIL FROM ties the bounce-handling and SPF alignment back to your own domain. Set up a subdomain like mail.yourdomain.com with its own MX and SPF records.
What about ARC and BIMI?
Both are optional. ARC (Authenticated Received Chain) preserves authentication results when an email passes through a forwarder, useful for newsletters but not table-stakes. BIMI (Brand Indicators for Message Identification) shows your logo next to messages in Gmail, but requires an SVG and a Verified Mark Certificate (VMC), which costs around $1,500/year. Worth doing once you're sending millions of messages a month, not on day one.
What goes wrong if you skip any of these?
Gmail will route to spam. Outlook will route to junk. Yahoo will mark as suspicious. None of these will tell you why. You'll just see your open rate stay flat while your competitor with the same content sees 30%. Before you blame the copy, check your DNS. The free deliverability scan reads your SPF, DKIM and DMARC records within 30 seconds. If the records turn out to be clean and the mail is still landing in spam, the list and the sending pattern are the next two places to look: how to fix email deliverability issues works through them in order.
How does SEMAOS handle this?
On the platform-shared sending domain (send.semaos.io), all four records are pre-configured. When you bring your own custom domain, SEMAOS shows you the records to add: an ownership TXT record and three DKIM CNAMEs, which it verifies, plus SPF and MX on a mail. subdomain for MAIL FROM. DMARC is yours to publish, and p=none is the place to start. Domain warmup caps a new custom domain on a 21-day ramp (100 / 500 / 2,000 sends per day) or on volume sent so far, whichever is stricter, before plan limits apply. So a new domain can't send thousands of emails in its first week.