If messages sent by your Node.js application still land in spam, inspect a copy of the message as the recipient received it. In its Authentication-Results header, compare the visible From: domain with the domain authenticated by SPF and the signing domain in the DKIM signature. DMARC passes when at least one of those authenticated identities passes and aligns with the visible From domain; passing SPF or DKIM alone does not prove alignment or guarantee inbox placement.
Start with a message that actually reached the recipient
A successful Nodemailer sendMail result or an SMTP server accepting a message confirms submission to that relay, not that the recipient put it in the inbox. Save the complete headers of an affected message from the spam folder. If possible, compare them with a similar message that reached the inbox.
As an Amazon Associate I earn from qualifying purchases.
Record the recipient system—such as personal Gmail, Google Workspace, Microsoft 365/Outlook, or another provider—and whether the message was sent directly, forwarded, or distributed through a mailing list. Requirements and the meaning of authentication results can vary by receiver and route. Google notes that its direct-mail alignment guidance for personal Gmail differs for indirect mail such as forwarding and mailing lists, where ARC headers are relevant (Google’s sender guidelines FAQ).
Free tools Windows power users keep installed
One-click scans. No signup required.
Read the three identities in the received headers
Find the receiving system’s Authentication-Results header. Record the SPF and DKIM results and identities, plus the DMARC result and any policy disposition. Then compare these fields:
#1 Best Overall
From:The visible author address and domain readers see. DMARC evaluates alignment against this domain.- SPF identity: The authenticated sending identity, commonly shown as
smtp.mailfromand associated with the SMTP envelope’sMAIL FROMdomain. It is not necessarily the visible From address. - DKIM identity: The domain in the signature’s
d=value, alongside the receiver’sdkim=result.
DMARC requires an authenticated SPF or DKIM identity that aligns with the visible From domain. The RFC Editor’s DMARC specification describes the authenticated identifiers and alignment; Microsoft’s authentication troubleshooting guide explains how a mismatch can produce a DMARC alignment failure.
| Received result | What it establishes | What to inspect next |
|---|---|---|
spf=pass, but dmarc=fail |
SPF authenticated the reported sending identity; that result alone does not establish that the identity aligned with From. | Compare the reported smtp.mailfrom domain with the visible From domain, then check whether DKIM passed with an aligned d= domain. |
dkim=pass, but dmarc=fail |
The receiver verified a DKIM signature, but a DKIM pass alone does not establish alignment. | Compare the signature’s d= domain with From; also check whether SPF passed with an aligned identity. |
dmarc=pass, but the message is in spam |
DMARC passed for that received message; authentication by itself does not guarantee inbox placement. | Check receiver-specific sending requirements, message handling, reputation signals and the full delivery route. |
dmarc=fail and neither SPF nor DKIM has an aligned pass |
Neither authenticated path satisfied DMARC alignment for the visible From domain. | Determine which identity is wrong or which authentication result failed, then verify the sending service’s DNS and message path. |
Trace SPF and DKIM through every sending service
List every service that sends mail for the domain, not only the Node.js application: production relays, transactional providers, marketing platforms, support systems and other senders. For SPF, check that the published record authorizes the actual sending service and that the message uses the expected envelope identity. Google advises including all senders in the SPF record; an unlisted third-party sender is more likely to have mail marked as spam. Avoid publishing multiple SPF records for one hostname; consolidate authorized senders into the intended record and follow the provider’s instructions (Google SPF setup guidance).
For DKIM, use the selector shown in the received signature to find the public key under the signing domain, and confirm it corresponds to the private key configured at the sending service. Check that the signature’s d= domain is one you intend to align with From. Nodemailer documents DKIM signing options including domainName, keySelector and privateKey in its project README.
Recommended Free Tools
If a DNS change was just made for Gmail, Google says SPF authentication may take up to 48 hours to start working. That is a setup-propagation note, not a promise that delivery will recover within that time. Check the authoritative DNS answer and the identities reported in newly received messages as well (Google SPF troubleshooting).
Rank #3
Find out whether the message changes after signing
DKIM verifies signed headers and message content. A relay, gateway, mailing list or transport rule that edits signed material after the application signs can make the signature fail. Nodemailer warns that SMTP services may change headers such as Message-Id or Date, invalidating a signature if those fields were signed. Microsoft also identifies body changes after signing as a possible cause of DKIM body-hash failure.
Determine where DKIM signing occurs in the actual route, then compare the generated message with the recipient’s received headers and body where possible. Check for header rewriting, footers, content filtering or other post-signing edits. Consult the Nodemailer README and Microsoft’s troubleshooting guidance for these failure modes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check the recipient’s requirements and delivery signals
Authentication and inbox placement are separate questions. For mail sent to personal Gmail accounts, Google’s current sender guidelines require all senders to use SPF or DKIM, have valid forward and reverse DNS for sending domains and IPs, use TLS, send RFC 5322-compliant messages and keep their spam rate below 0.3% in Postmaster Tools.
Google’s additional bulk-sender requirements apply when a sender exceeds 5,000 messages per day to Gmail accounts; Google’s FAQ says the volume counts across subdomains under the same primary domain. Those senders must use SPF, DKIM and DMARC, set DMARC to at least p=none, align the From domain with SPF or DKIM for direct mail, and support one-click unsubscribe for applicable promotional or subscribed messages. For Google’s stated direct-mail alignment requirement, only one of SPF or DKIM must align, though Google recommends aligning both for reliability. These are Gmail-specific requirements, not a universal rule for every mailbox provider (Google’s sender guidelines FAQ).
For Gmail delivery, the Google Postmaster Tools dashboards provide aggregated views of SPF, DKIM and DMARC authentication percentages and sender compliance status. Use those alongside the affected message’s headers: a dashboard can show a broader pattern, while a single received message shows how that copy authenticated. Google notes that third-party modification can cause SPF and DKIM to fail, affecting DMARC.
Use SMTP error codes as clues, not a spam-folder diagnosis
If the provider returned an SMTP error, capture the full response and match it with the corresponding received-message results. Google documents 4.7.27 and 5.7.27 for SPF failure, 4.7.30 and 5.7.30 for DKIM failure, and 4.7.32 for From-header alignment problems in bulk-sender contexts (Google SMTP errors and codes). A generic report that a message went to spam does not identify which DNS record or authentication path is responsible.
Debug the Node.js route, not just the signing configuration
Nodemailer can sign messages with DKIM, but the recipient’s copy is the evidence that matters: the configured signature may pass before a downstream service alters the message. Verify the installed Nodemailer version and consult its current official documentation before adopting an older configuration example; README branches and APIs can change. The project README documents signing configuration and warns about downstream header modification (Nodemailer README).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For a focused escalation, assemble the complete received headers, timestamp and recipient provider; a sanitized description of the sending route and Nodemailer version; relevant SPF, DKIM selector and DMARC DNS answers; provider delivery logs; and Gmail Postmaster Tools data if Gmail is involved. Remove message content, email addresses, tokens and private-key material before sharing publicly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
