When operational mail starts landing in spam, the instinct is to rewrite the subject line. Usually the cause is duller and more fixable: the receiving server cannot confirm you are allowed to send as your own domain.
The three records
SPF — who may send as you
A DNS record listing the servers permitted to send mail using your domain. If you send through a platform whose servers are not in that list, the check fails. Watch out for a common trap: mail often leaves through a relay, so the IP that matters is the relay’s, not your web server’s.
DKIM — proof nothing was altered
A cryptographic signature added to each message and verified against a public key in your DNS. It proves the mail genuinely came from you and arrived unmodified — and unlike SPF, it survives forwarding.
DMARC — what to do when a check fails
A policy telling receivers how to treat mail that fails the other two, plus an address for reports. Start at p=none so you can watch without blocking anything, read the reports, and only tighten once legitimate mail is passing cleanly.
Alignment is the part people miss
SPF can pass while DMARC still fails. DMARC requires the domain in the visible From address to match the domain that actually authenticated. On relay setups the return path often belongs to the sending platform, which passes SPF for the wrong domain. DKIM signed with your own domain fixes the mismatch.
How to check
Send yourself a message and open the raw headers — in Gmail, Show original. You want SPF: PASS and DKIM: PASS, both against your own domain. If either says none or fail, that is your deliverability problem, and no amount of subject-line work will move it.