Mail still goes to spam even though DKIM, SPF and DMARC are all set

[DeveloperSarim]

I set up RayMail, added the A, MX, SPF, DKIM and DMARC records exactly as deploy/dns-records.py printed them, and mail still lands in the Gmail spam folder. DKIM is signing. What am I missing?

[DeveloperSarim]

Passing DKIM is not the same as passing DMARC, and that is almost always the cause.

The alignment trap

If you relay outbound mail through a provider (Resend, SendGrid, Postmark, SES), your envelope Return-Path is usually a subdomain they control, for example send.mail.example.com, while your From: header stays mail.example.com.

DMARC then checks whether those two align:

Policy	send.mail.example.com vs mail.example.com
aspf=s (strict)	fails — not an exact match
aspf=r (relaxed)	passes — same organisational domain

So a record like this fails SPF alignment on every single relayed message:

v=DMARC1; p=quarantine; adkim=s; aspf=s

And p=quarantine literally instructs the receiver to put failures in the spam folder. Strict alignment plus quarantine is a self-inflicted spam rule.

Use relaxed alignment, and start at p=none while you warm up:

v=DMARC1; p=none; rua=mailto:dmarc@mail.example.com; adkim=r; aspf=r; pct=100

Tighten to p=quarantine once your rua reports come back clean.

Check the receiver's verdict, do not guess

In Gmail, open the message, then the three-dot menu, then Show original. It prints the actual result:

SPF:   PASS with IP 54.x.x.x
DKIM:  PASS with domain mail.example.com
DMARC: PASS

That tells you which of the three is failing. Debugging DNS without it is guesswork.

The other two causes, in order

PTR mismatch. Your reverse DNS must match your mail hostname. Check with:

dig +short -x YOUR_IP     # must return mail.example.com

A default like srv123456.hostinger.cloud is a real negative signal. Set it in your provider's control panel, not in your DNS zone.

Domain reputation. This is the one nobody wants to hear. A domain that started sending last week has no reputation, and Gmail treats it with suspicion no matter how perfect your authentication is. Nothing in DNS fixes that. Send low volume to engaged recipients, keep bounces near zero, and it improves over weeks.

If Show original says all three PASS and mail is still filed as spam, you are looking at reputation, not configuration.