Emails going to spam
Invoices, password resets and newsletters landing in junk — or rejected outright since Google and Yahoo started enforcing their bulk-sender rules.
[ Servers & DevOps ]
DNS Management & Email Deliverability Services
Mail in the inbox. Site always reachable.
DNS is a handful of records nobody touches for years, until an email campaign lands in spam, a registrar transfer takes the site offline, or a forgotten CNAME gets taken over. I audit it, fix it and move it without anything breaking.
Every record checked · TTLs planned ahead · $20/hr or fixed price
Zerodowntime DNS moves
SPF, DKIMand DMARC aligned
p=rejectreached safely, not blindly
Same dayfor most urgent fixes
[ Why you're here ]
Small records, large consequences.
Almost every DNS emergency comes back to one of these six.
SPF broken by too many lookups
Every tool added its own include until the record passed the 10-lookup limit and started failing with a permerror.
Someone spoofing your domain
No DMARC policy, so anyone can send phishing mail that looks like it came from you, and you have no reports to show it is happening.
Site not reachable
DNS_PROBE_FINISHED_NXDOMAIN, SERVFAIL, or a site that loads for you but not for customers after a record or nameserver change.
A risky migration ahead
Changing registrar, DNS provider or email platform, with no complete list of which records exist or which ones matter.
Dangling records
CNAMEs pointing at deleted Heroku apps, S3 buckets or Azure resources — exactly what subdomain takeover attacks look for.
[ How it works ]
Audit, plan, change.
01 — Day 1
Audit
Every record in the zone listed and explained: what it points at, whether it is still used, and whether it is a risk. Email authentication checked against real message headers and DMARC reports, not guesses.
02 — Day 1-3
Plan
TTLs lowered well before any change, a record-by-record migration map written, and a rollback defined. For DMARC, a staged path from p=none to quarantine to reject, based on what the reports show.
03 — Change
Switch & verify
Changes made in a quiet window and checked from multiple resolvers worldwide. Test mail sent to Gmail, Outlook and Yahoo, with headers confirming SPF, DKIM and DMARC pass and align.
[ What actually changes ]
What gets done.
DNS and email authentication are covered together, because most deliverability problems are really DNS problems.
DNS & migrations
- Full record audit — A, AAAA, CNAME, MX, TXT, SRV, CAA and NS records inventoried, with unused and risky entries flagged.
- Zero-downtime migrations — between registrars and providers such as GoDaddy, Namecheap, Route 53, Cloudflare and Google Cloud DNS, with TTLs lowered days ahead.
- Dangling record cleanup — CNAMEs and A records pointing at resources you no longer own, removed before someone else claims them.
- DNSSEC — enabled where your registrar supports it, and removed in the right order before a provider change so the domain does not go dark.
- CAA records — limiting which certificate authorities may issue certificates for your domain.
- Propagation and resolution issues — NXDOMAIN, SERVFAIL, stale nameservers and split results traced with dig, not by waiting another 48 hours.
Email deliverability
- SPF — one record, under the 10-lookup limit, covering every service that actually sends as you and nothing that does not.
- DKIM — 2048-bit keys for Google Workspace, Microsoft 365 and each sending platform, such as Mailchimp, SendGrid, Postmark or Amazon SES.
- DMARC — starting at p=none with aggregate reporting, then moved to quarantine and reject once every legitimate sender aligns.
- Google and Yahoo bulk-sender rules — authentication, alignment and one-click unsubscribe in place, with spam rates watched in Google Postmaster Tools.
- MX for Google Workspace and Microsoft 365 — set up or migrated without losing mail in transit.
- Blocklist and reputation checks — listings found and delisting requested once the underlying cause has been fixed.
[ Example engagement ]
Invoices out of spam, spoofing shut down.
A small company whose invoices and password resets were landing in Gmail spam. SPF had 14 lookups and was failing, two sending tools had no DKIM, and there was no DMARC record. Fixed the records, then moved DMARC to p=reject over six weeks.
Illustrative example of a typical engagement. Figures vary with the state of your systems and are not a guarantee of a specific outcome.
7SPF lookups, down from 14
100%DMARC pass on legitimate mail
6 wksto p=reject
0mail lost in the switch
[ Free · quick check ]
Not sure why mail goes to spam?
Send me your domain. I will check your SPF, DKIM, DMARC and MX records and tell you what is wrong in plain language, whether or not you hire me to fix it.
[ Pricing ]
Straightforward pricing. $20/hour or fixed.
Tell me the number you have to work with. I'll tell you honestly what's achievable within it — and if it isn't enough, I'll say so before we start rather than halfway through.
Hourly rate $20/hoursmall jobs and ongoing work · fixed price for defined projects
Fixed project price
Scope agreed in writing, price agreed in writing, before any work starts. No hourly creep and no invoice you haven't already approved.
Monthly retainer
For ongoing work — maintenance, monitoring, updates and small changes. Month to month, cancel whenever, no minimum term.
$20/hour for small jobs
For a single bug, a short task or ongoing tweaks, where writing a full scope would cost more than simply doing the work. Billed in real time, reported in writing.
Budget too tight for the whole thing? I'll often suggest doing the highest-value part first and the rest later, rather than doing all of it badly.
[ Questions ]
Common questions.
How much does DNS or email authentication work cost?
Small fixes, like an SPF record or adding DKIM for a new sending tool, are billed at $20 per hour and usually take an hour or two. Migrations and full deliverability projects get a fixed price, agreed in writing before any work starts.
Why are my emails going to spam?
The most common causes are an SPF record that fails or exceeds 10 lookups, missing DKIM for one of your sending services, no DMARC record, or a From domain that does not align with the domain actually signing the mail. Sometimes it is content or reputation, but authentication is where I look first because it is the easiest to prove and fix.
What are Google and Yahoo's bulk-sender requirements?
Anyone sending around 5,000 or more messages a day to Gmail or Yahoo needs SPF and DKIM, a DMARC record, alignment with the From domain, one-click unsubscribe on marketing mail and a spam complaint rate kept below 0.3%. Smaller senders still need SPF or DKIM, and in practice should have both.
Can you move my DNS without the website or email going down?
Yes. I lower TTLs a few days in advance, recreate every record at the new provider and verify it before changing nameservers, and leave the old zone in place until propagation is complete. MX, SPF and DKIM records get checked twice, because they are what usually breaks.
Will turning on DMARC block my own emails?
Not the way I do it. DMARC starts at p=none, which only collects reports. Once the reports show every legitimate sender passing, the policy moves to quarantine and then reject. Jumping straight to reject is how companies stop their own invoices.
Why does my site work for me but not for customers?
Usually a cached answer: your resolver still has the old record, or theirs does. It can also be a DNSSEC mismatch, a missing www or AAAA record, or nameservers at the registrar that do not match the zone you are editing. I check from multiple public resolvers to find out which.
What is subdomain takeover, and am I at risk?
If a DNS record points at a cloud resource you have deleted, such as a Heroku app, S3 bucket or Azure site, someone else can often create that resource and serve content on your subdomain. The audit lists every record like that so it can be removed.
Do you work with clients in other countries?
Yes. I work remotely with clients in the US, UK, Germany, Canada, Australia and elsewhere. DNS changes are scheduled for your quiet hours, not mine.
[ Related services ]
Related work.
Cloudflare SetupDNS, SSL, WAF and caching on Cloudflare, configured properly.Server MigrationMove hosts without losing data, email or search rankings.Migration to AWSMove from shared hosting, a VPS or another cloud without downtime.WordPress MigrationMove hosts or domains without downtime or losing rankings.Server Security HardeningLock down SSH, firewall, patching and access before it costs you.AWS Server SetupProduction-ready VPC, compute, database and CI/CD from scratch.
[ Guides on this topic ]
From the blog.
SPF, DKIM and DMARC Setup: Records That Actually WorkSPF DKIM DMARC setup with real records for Google Workspace and Microsoft 365, the 10-lookup SPF limit, and a safe DMARC rollout to stop emails going to spam.Cloudflare DNS Setup: Settings I Use When Moving a SiteCloudflare DNS setup done safely: audit your zone, handle DNSSEC, choose proxied vs DNS only, use Full (strict) SSL and keep email flowing after the switch.Migrate a Website to a New Host Without DowntimeHow to migrate a website to a new host without downtime: lower DNS TTL, sync, test via hosts file, cut over, keep a rollback, and protect your SEO rankings.
[ Let's talk ]
Tell me what's broken.
Describe the problem in a few lines and you'll get a real reply from the person who'd do the work — same working day, no discovery call required.