Why emails from staging land in spam: SPF, DKIM and DMARC

Updated October 16, 2026 · Zyntra

Staging mail lands in spam, or never arrives, when the sending domain fails authentication: no SPF record that covers the provider, no DKIM signature from your domain, or a From address whose domain doesn't line up with either. Read the headers of an email that did arrive to see which domain signed it and which envelope sender it used, then fix the DNS records for that domain.

Three checks in one minute

  • SPF (RFC 7208): a TXT record on the envelope sender's domain lists the servers allowed to send for it. The envelope sender appears as Return-Path on the received email.
  • DKIM (RFC 6376): the provider signs the message; the d= tag in the DKIM-Signature header names the signing domain and s= the selector, whose public key lives at s._domainkey.d in DNS.
  • DMARC (RFC 7489): a policy at _dmarc. your From domain. It passes when SPF or DKIM passes for a domain that aligns with the From domain.

Why staging gets it wrong

  • Staging sends from staging.example.com or example-staging.com, a domain nobody added to the provider, so the signature is the provider's own domain and nothing aligns with From.
  • A separate provider account or sub-account for staging, never set up beyond the defaults.
  • An SPF record that lists production's provider but not the one staging uses.

Read the headers of a received email

inspect-auth.ts
const res = await fetch(
  `https://api.zyntra.app/emails/last?email=${encodeURIComponent(address)}`,
  { headers: { "X-API-Key": process.env.ZYNTRA_API_KEY! } },
);
const { headers, from_address } = await res.json();

console.log("From:", from_address);
console.log("Return-Path:", headers["return-path"]);
console.log("DKIM-Signature:", headers["dkim-signature"]);
// Look for d=<domain> and s=<selector> in the signature.

Then check DNS for the domains you found:

terminal
dig +short TXT staging.example.com          # SPF: v=spf1 ...
dig +short TXT s1._domainkey.example.com     # DKIM public key for selector s1
dig +short TXT _dmarc.example.com            # DMARC policy

Why it matters even for test mail

Since February 2024 Google requires every sender to Gmail to use SPF or DKIM, and senders of more than 5,000 messages a day to use SPF, DKIM and DMARC with alignment. A staging setup that skips authentication tells you nothing about whether production mail will reach Gmail users, and a test inbox that receives the mail does not prove it would pass those checks. Read the headers.

Questions

Can I see whether SPF and DKIM passed?
The receiving server records its verdict in an Authentication-Results header when it checks. Gmail shows it under "Show original". If the server you test with does not add one, check the DNS records and the signature's domain as above.

Sources