Emails from a new domain going to spam: authenticate first, then build up slowly

Step 1: Authenticate your domain

Gmail's sender guidelines set the baseline. For every sender: "Set up SPF or DKIM email authentication for your sending domains." For 5,000 or more messages a day: SPF and DKIM and DMARC, with the visible From address "aligned with either the SPF domain or the DKIM domain."

1. SPF: one TXT record at your domain listing your senders. See no SPF record found.
2. DKIM: your email provider (Google Workspace, Resend, Postmark and others) gives you DNS records to add; then switch signing on in its dashboard. Gmail requires a DKIM key of 1024 bits or longer for mail to personal Gmail accounts and recommends a 2048-bit key if your provider supports it.
3. DMARC: a TXT record at _dmarc, starting with p=none. See no DMARC record found.
4. Send from your own domain, not a free mailbox, so the From address matches what you authenticated.

Step 2: Build a sending history slowly

Gmail's guidelines for growing volume:

• "Start with a low sending volume to engaged users, and slowly increase the volume over time."
• "Avoid introducing sudden volume spikes if you do not have a history of sending large volumes."
• "Send email at a consistent rate. Avoid sending email in bursts."
• Keep spam complaints low: Gmail asks senders to "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher."

Resend's guide for new domains says the same from the sending side: "A brand-new domain has no track record," so send the mail people expect first (sign-up confirmations, login codes), mail only people who opted in, and ask early recipients to mark your mail "Not spam" if it lands there.

Step 3: Check what receivers see

1. Send a message to a mailbox you control, open its full headers, and confirm SPF, DKIM and DMARC each show "pass".
2. Gmail: "As you gradually increase your sending email volume, you should monitor your email delivery with Postmaster Tools."
3. If messages start bouncing or being deferred, Gmail's advice is to reduce the sending volume until the error rate drops.

What Pewterkit Check looks at

For an app on its own domain, the check reads your SPF record (missing, more than one, or ending in +all) and your DMARC record (missing, more than one, or without a policy). It doesn't read DKIM, because DKIM keys sit under selector names only your email provider knows, so confirm DKIM in your provider's dashboard or in a message's headers as above. Sending reputation and content aren't something a scan of your site can see.