You rebranded, moved your business to a fresh domain, and now every message you send drops straight into the recipient’s spam folder. The same emails from your old domain used to reach the inbox without a second thought, so it feels like something broke on purpose. The reflex is to start flipping DNS settings at random and hope one of them helps, which usually makes the situation muddier and harder to diagnose. Here is the part almost nobody tells you: Gmail already writes down exactly which check failed on every message it receives, and you can read that verdict in about a minute. Once you can see whether SPF, DKIM, or DMARC alignment is the actual problem, the fix stops being a guessing game and becomes a short, ordered checklist. This guide walks you through reading that evidence and correcting the right record, plus the reputation problem a fresh domain carries that no DNS entry can fix.

The Straight Answer: when a new domain sends to spam, do not touch DNS until you have read the proof. Open one of your emails in the recipient’s account, use Show Original in Gmail, and read the Authentication-Results line. It states SPF, DKIM, and DMARC as pass or fail, and whether each aligned with your From domain. Fix in this order: SPF to a single record listing only real senders, DKIM turned on for the new domain with its key published, then DMARC alignment. After the records pass, treat the rest as a reputation problem, because a fresh domain has no sending history and needs a gradual warm-up.

A domain switch resets two things at once, and both push you toward the spam folder. The first is authentication. Your old domain had SPF, DKIM, and DMARC tuned over months, and the new one starts with either nothing or a half-copied set of records that point at the wrong places. The second, and the one people forget, is reputation. Mailbox providers judge a sending domain partly on its history, and a brand-new domain has none, so it starts from a cautious, unproven position no matter how legitimate you are. Google spells out its expectations in its email sender guidelines, which now treat proper authentication as a baseline rather than a bonus. If you are still in the planning stage of a move, our companion piece on the questions to ask before switching your business email domain covers the warm-up sequencing that prevents this mess in the first place. If you are already stuck in spam, keep reading, because the fix is methodical.

This is the step that removes the guesswork, and most people skip it. Send a test message to a Gmail address you control, open it there, click the three-dot menu, and choose Show Original. Near the top you will see an Authentication-Results block that reports SPF, DKIM, and DMARC as pass, fail, or neutral, and crucially whether each one aligned with the domain in your From address. This single view tells you which of the three is actually broken, so you stop fixing records that were never the problem. Pay special attention to alignment, because a message can show SPF pass and still fail DMARC if the passing domain does not match your visible sender. Write down what you see for each of the three checks before changing anything. That snapshot is your map, and every fix below targets a specific line in it rather than a vague hunch that something in DNS is wrong.

SPF problems after a switch almost always come from one of three mistakes. You published two separate SPF records, which is invalid and causes a permanent error, so a domain must have exactly one TXT record that begins with v=spf1. You left includes from your old provider that no longer send for you, or worse, you forgot to add the new sending source, so the server actually delivering your mail is not listed. For Google Workspace the record needs include:_spf.google.com, and if you also send through a CRM, a newsletter tool, or a helpdesk, each of those needs its own include. Google’s SPF setup reference lists the exact value to publish. Keep the total number of DNS lookups under ten, because going over that limit also breaks SPF. Once your record is a single line naming every genuine sender and nothing stale, recheck the header and confirm SPF now passes and aligns.

DKIM is the check people most often forget on a new domain, because moving your mail service does not carry the old signing key over. In Google Workspace you have to generate a fresh DKIM key for the new domain in the Admin console, publish the provided TXT record at the selector host, and then turn signing on, which is a step separate from creating the key. A very common failure is generating the key, publishing the DNS entry, and never flipping the switch to start signing, so DKIM silently stays off. Follow Google’s DKIM instructions to create the key, add the record exactly as given, wait for it to propagate, and then enable authentication. Send another test and confirm the header shows DKIM pass with your own domain in the signature. DKIM alignment matters more than SPF for DMARC, because it survives forwarding, so getting this one right buys you the most durable inbox placement.

DMARC is the policy that ties SPF and DKIM to the domain your recipients actually see in the From field, and this is where a lot of new setups fall down. A message passes DMARC only if SPF or DKIM passes and the passing domain aligns with your visible sender. So you can have a green SPF result and still fail DMARC because the aligned domain does not match. Publish a TXT record at _dmarc.yourdomain.com starting at p=none while you monitor, then tighten to p=quarantine, and only move to reject once your reports are clean and every real sender aligns. Do not jump straight to reject on a fresh domain, because one unaccounted sender will send legitimate mail to spam. If a lot of your failures come from forwarded mail, that is expected and not something you misconfigured. For the full tightening sequence, our DMARC p=reject checklist walks through moving up the policy ladder safely, and if your trouble is bounces rather than spam placement, the DMARC passes but emails still bounce flow covers that separate failure.

Here is the hard truth once your three records pass and align: you can still land in spam, because authentication only proves you are allowed to send, not that you are worth trusting. Mailbox providers lean heavily on reputation and engagement, and a brand-new domain has neither. The way you build it is boring but reliable. Start with low volume to people who know you and will open and reply, since replies are one of the strongest positive signals. Ask a few close contacts to move your message from spam to the inbox, because that manual action teaches the filter. Grow your sending volume gradually over a few weeks rather than blasting your whole list on day one. Watch your content too, since a signature stuffed with external images and links, or copy that reads like a promotion, can tip a borderline message into spam. Our roundup of email mistakes that destroy open rates covers the engagement habits that quietly decide placement.

Match what the Authentication-Results line told you to the most likely cause and the fix. Change one thing, resend a test, and reread the header before moving on.

Do not declare victory from a single inbox. After each change, run your message through a scoring tool like mail-tester, which checks your authentication, blacklist status, and content in one pass and gives you a plain score to chase. Send test messages to a few different providers beyond Gmail, and open the header on each to confirm all three checks pass and align. Do a blacklist scan on the new domain and IP, because a shared or previously abused address can drag you down independent of your records. If you have worked through SPF, DKIM, DMARC, reputation, and content and still cannot get out of spam, that is the point where a specialist earns their fee, and our guide to the questions to ask before hiring a deliverability freelancer helps you pick one who audits the whole footprint. If you are still weighing providers, our Gmail versus Outlook for business email comparison covers the sending side of that choice.

This article is general educational information about email configuration and deliverability, not legal, financial, or professional IT advice. Deliverability depends on many factors outside any single setting, and no configuration can guarantee inbox placement. Verify every DNS change carefully, keep a record of what you had before you edit it, and consult your email provider or a qualified professional for your specific setup.

Because a switch resets both authentication and reputation. Your new domain often has missing or misconfigured SPF, DKIM, and DMARC records, and even once those pass it has no sending history for mailbox providers to trust. The old domain earned its inbox placement over time, so the new one has to prove itself through correct records and a gradual warm-up before it reaches the same standing.

Open the message in a Gmail account, click the three-dot menu, and choose Show Original. The Authentication-Results block at the top reports SPF, DKIM, and DMARC as pass or fail and whether each aligned with your From domain. That verdict tells you which specific check is broken, so you can fix the right record instead of changing DNS settings at random and hoping.

Yes, and it is a common surprise. DMARC requires that a passing SPF or DKIM result aligns with the domain in your visible From address. If SPF passes for a different domain than the one recipients see, the check passes technically but DMARC fails on alignment. Because DKIM alignment survives forwarding, getting DKIM right is usually the more reliable path to consistent DMARC pass.

No. Start at p=none to monitor, move to p=quarantine after your reports look clean, and only reach reject once every legitimate sender aligns. Jumping straight to reject on a fresh domain risks sending real mail to spam if you missed a sending source. Give yourself a couple of weeks at each step and watch the reports before tightening the policy further.

That points to reputation and content rather than authentication. Warm the domain by starting with low volume to engaged contacts, ask a few to move your mail out of spam, and grow sending gradually. Trim heavy images and excessive links from your signature and copy. Run a blacklist check on the domain and IP, and use a scoring tool to catch content or listing issues your records cannot show.

• Read the Authentication-Results header with Show Original first, and note SPF, DKIM, and DMARC results plus alignment before changing anything.
• Fix SPF to a single TXT record naming only real senders, under ten DNS lookups, with no stale old-host includes.
• Generate the new domain’s DKIM key, publish the selector record, and actually turn signing on in the Admin console.
• Publish DMARC at p=none, confirm alignment, then climb to quarantine and reject only when reports are clean.
• Warm the fresh domain gradually, drive real replies, run a scoring tool and blacklist check, and test across several providers.

A domain switch that dumps you in spam feels like sabotage, but it is almost always a short list of fixable causes hiding behind a verdict Gmail hands you for free. Read the header, and the mystery collapses into a specific broken check you can correct in order: one clean SPF record, DKIM actually signing, DMARC aligned and climbing its policy ladder carefully. Then accept that a new domain has to earn trust the slow way, through small, engaged sends that build a reputation no DNS entry can shortcut. Stop guessing, start reading the evidence, and fix the one record that is actually failing. Do that, and the inbox opens back up faster than another afternoon of blindly editing DNS ever will.