Gorgias Emails Going to Spam or Not Sending: Fixes (SPF & DKIM)

First, tell "not sending" apart from "going to spam"

These are two different failures and they point at different fixes. If Gorgias shows an error on the outbound message or the reply never leaves at all, you are likely looking at an unverified custom domain that Gorgias will not send from, a disconnected email channel, or the recipient's server hard-bouncing you. If the mail leaves cleanly but lands in Spam or Junk — or arrives hours late — that is a deliverability and reputation problem, and SPF, DKIM, and DMARC are the levers. The good news is that the same domain-verification work fixes both, because Gorgias treats verified authentication as a prerequisite for reliable sending, not a nice-to-have.

The ranked causes and their fixes

1. Your custom sending domain isn't verified (the big one)

This is the root cause behind the large majority of "spam" and "not sending" reports. To meet modern email authentication requirements, the domain you send from has to be verified inside Gorgias by publishing DNS records — and per Gorgias's own docs, "verifying your domain is required before you'll be able to send email from Gorgias" when you use automatic forwarding. A verified domain also gets you improved delivery times, fewer bounces, and fewer messages dropped into Spam or Junk.

The fix, following Gorgias's domain-verification guide:

1. Open Settings → Channels → Email, select your support email address, and click Verify Domain. Gorgias generates a unique set of DNS values for your domain.
2. In your domain registrar's DNS, create a TXT record for SPF: set the Host/Name to @ and paste the entire Value string that starts with v=spf.
3. Create a second TXT record for DKIM: set the Host/Name to the value Gorgias gives you that starts with pic_domain, and paste the Value string that starts with k=rsa.
4. Save, return to Gorgias, and click Check Status.

That last step matters: once the records exist, it can take up to 72 hours for verification to finalize. Nothing you do speeds this up — DNS propagation and provider caching set the clock. Publish the records, then leave it alone for a day or two before assuming the fix failed. Honest note: this whole panel only appears once you've added a custom send-from domain. On a default @email.gorgias.com forwarding address there's no DKIM/SPF verification surface to configure, which is exactly why deliverability is weaker on the default address — you're borrowing Gorgias's shared reputation instead of authenticating your own domain.

2. You signed with Gorgias's DKIM keys instead of your own

A subtle trap. For DKIM to authenticate mail for your domain, the record has to carry your key — the one Gorgias generated for your domain in step 3 above — not Gorgias's generic key. As Stellastra's deliverability writeup on stopping Gorgias emails going to spam puts it, "in order for Gorgias's email to pass authentication for your own domain, it is necessary to use your own DKIM keys." Get this wrong and Gmail shows the message as "via gorgias.com" or "on behalf of gorgias.com," which is a well-known ticket straight to the junk folder. If your replies look right but display that "via" line, re-copy the pic_domain host and k=rsa value from your Gorgias verify panel, not from a generic tutorial.

3. Copy-paste errors in the TXT record values

DNS is unforgiving about exact strings. The most common self-inflicted failures: a stray leading or trailing space when you paste the v=spf or k=rsa value; a line break your registrar inserted into a long DKIM value; or the value pasted into the wrong field (Host vs Value). Paste the full string, trim whitespace at both ends, and confirm your registrar didn't split it. After saving, use a public "SPF/DKIM checker" or your registrar's record viewer to read back exactly what's published before you blame Gorgias.

4. You already had an SPF record — and now there are two

A domain may have only one SPF (v=spf1) TXT record. If you already send transactional email through Shopify, Klaviyo, or another tool, you likely have an existing SPF record. Adding a second, separate one for Gorgias doesn't stack — mailbox providers see conflicting records and SPF fails outright, which cascades into DMARC failure. The fix is to merge: keep a single v=spf1 record that includes every sender's mechanism (Gorgias's include plus your existing ones) and ends in ~all or -all. This is a frequent regression cause when someone "adds Gorgias" months after the store's email was already set up.

5. No DMARC record, so Gmail and Yahoo distrust you

Since February 1, 2024, Google and Yahoo enforce bulk-sender requirements: senders pushing more than 5,000 messages a day to Gmail must authenticate with SPF, DKIM, and a published DMARC policy, with the FROM domain aligned to SPF or DKIM. Even below that threshold, a DMARC record meaningfully improves placement — and Stellastra notes the "main cause of Gorgias emails being blocked is due to the Gorgias emails failing DMARC," usually a downstream symptom of SPF/DKIM being off. Add a TXT record at _dmarc.yourdomain.com with a value like v=DMARC1; p=quarantine; rua=mailto:[email protected]. Start at p=quarantine and only move to p=reject once your reports show clean alignment.

6. The email channel itself is disconnected or misconfigured

If nothing sends at all — not even to your own test address — step back from DNS and check the channel. In Settings → Channels → Email, confirm the address shows as connected and, for Google/Microsoft-connected inboxes, that the OAuth authorization hasn't lapsed. A revoked mailbox connection or an expired forwarding rule produces "not sending" that no amount of SPF tuning will fix. If tickets stop arriving and replies stop going out together, suspect the channel connection before the DNS.

A quick word on volume — and why fewer emails helps

Deliverability is partly a reputation game, and reputation is shaped by how much mail you send and how recipients react to it. High volumes of low-value automated replies (order-status pings, "we received your message" acknowledgements) train filters to treat your domain with suspicion, especially if some bounce. Anything that trims unnecessary outbound — resolving simple questions before they generate a back-and-forth — quietly protects your sender reputation. That's one reason ecommerce teams pair a well-authenticated Gorgias with an AI layer that handles routine questions in-thread.

Where an AI layer fits (honestly)

None of the above is Gorgias's fault — this is how internet email works, and the same SPF/DKIM/DMARC steps apply to every sender. But once your domain is authenticated, the next lever is sending fewer, better messages. Macha is an AI agent layer that runs on top of the Gorgias you already use — it is not a help desk replacement and it doesn't touch your DNS. It reads and writes the same tickets your agents do, so it can resolve the repetitive "where's my order?" and "how do I return this?" questions before they turn into multi-email threads, which keeps your outbound volume — and therefore your reputation — leaner. If you're still deciding whether Gorgias is the right base at all, what is Gorgias and the Macha–Gorgias integration overview cover the connection model, and Gorgias AI agent explained compares native automation with an added agent layer.

Because an agent acts on the meaning of a message rather than a keyword rule, you can extend what it does through a custom tool that turns any REST API into an action — looking up live order or tracking status mid-reply, so a single accurate answer replaces a chain of clarifying emails. If you already lean on Gorgias rules to triage the inbox, an AI layer complements them: rules route, the agent resolves. See pricing — credits are charged per AI action, not per resolution — for how that scales.

FAQ

Why are my Gorgias emails going to spam? Almost always because your sending domain isn't authenticated. Verify your custom domain in Settings → Channels → Email → Verify Domain, then publish the SPF (v=spf, host @) and DKIM (pic_domain host, k=rsa value) TXT records Gorgias gives you. Missing or mismatched SPF/DKIM causes DMARC to fail, and Gmail and Yahoo route failing mail to Junk.

How long does Gorgias domain verification take? Up to 72 hours after you save the DNS records and click Check Status in Gorgias. DNS propagation and provider caching set that timeline — you can't speed it up, so publish the records and wait a day or two before assuming it failed.

Why do my emails say "via gorgias.com" and land in spam? That header means the mail was signed with Gorgias's own DKIM key rather than your domain's key. Re-copy the pic_domain host and k=rsa value from your Gorgias verify-domain panel so DKIM authenticates for your domain, and the "via" line disappears.

Do I need DMARC for Gorgias? If you send more than 5,000 messages a day to Gmail, yes — Google and Yahoo have required SPF, DKIM, and a DMARC policy since February 2024. Below that, a DMARC record still improves inbox placement. Add a _dmarc TXT record starting at p=quarantine.

My emails never send at all — is that also SPF/DKIM? Not necessarily. If nothing leaves, first check the email channel connection in Settings → Channels → Email (an expired OAuth authorization or broken forwarding rule stops sending regardless of DNS). Also note that on a custom domain, Gorgias requires verification before it will send.

Authenticated your domain and want to cut the email volume behind these tickets? Start a free trial and grade a Macha agent against your own Gorgias history before it touches a live queue.