My Newsletter Went to Spam: How I Fixed Email Deliverability for Free with Cloudflare

It started with a WhatsApp message from a friend: "Hey, I subscribed to your newsletter, but I never received the confirmation email."

I told him to check his Spam folder. "Yep, it's right here," he replied.

That was an immediate red flag. I rushed to check my Kit (ConvertKit) dashboard and noticed a troubling trend: my open rates had plummeted over recent months. I was sending newsletters using my personal @gmail.com address, assuming that was good enough for a personal developer blog.

It turns out I was breaking the fundamental rules of email authentication.

Let's look at why personal email addresses fail at sending newsletters and how to fix it permanently.

1. The Core Problem: DMARC, SPF, and "Fake" Senders 🚫

In early 2024, Google and Yahoo introduced strict anti-spam enforcement rules. In short:

If an email claims to be from @gmail.com but originates from a third-party server (Kit, Mailchimp, Resend, or Brevo), email providers treat it as email spoofing.

To pass automated email security filters, email providers check three key records:

1. SPF (Sender Policy Framework): Declares which servers are authorized to send emails for your domain.
2. DKIM (DomainKeys Identified Mail): Adds a cryptographic digital signature to verify the email was not altered in transit.
3. DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving mail servers how to handle messages that fail SPF or DKIM checks (e.g. p=none or p=quarantine).

You cannot configure SPF or DKIM keys for the @gmail.com domain because Google owns it. You must send from a custom domain (like hola@danywalls.com).

The dilemma? Paying $6 to $10 per month for a Google Workspace or Microsoft 365 mailbox just to send a weekly blog newsletter adds up quickly.

Let's look at how Cloudflare solves this without extra monthly subscriptions.

2. The Solution: Cloudflare Email Routing + Custom Domain ☁️

If your domain DNS is managed by Cloudflare, you have access to a built-in feature called Cloudflare Email Routing:

• Inbound (Receiving): Anyone emailing hola@danywalls.com has their message automatically forwarded to my-personal@gmail.com by Cloudflare.
• Outbound (Sending): Your newsletter platform (Kit, Resend, or Mailchimp) sends emails with your custom sender identity (hola@danywalls.com) signed with your domain's verified DKIM/SPF keys.

This architecture gives you 100% email deliverability and professional branding for $0/month.

Now let's walk through the 10-minute implementation guide.

3. Step-by-Step Implementation Guide 🛠️

Step 1: Enable Email Routing in Cloudflare

1. Open your Cloudflare Dashboard and select your domain.
2. Navigate to Email > Email Routing.
3. Click Get Started and configure your custom address:
   • Custom Address: hola (creates hola@danywalls.com)
   • Destination Address: your-personal-email@gmail.com
4. Cloudflare sends a confirmation email to your personal inbox. Click the verification link to activate forwarding.
5. Accept Cloudflare's prompt to automatically add the required MX and TXT records to your DNS zone.

Now incoming emails to your custom domain land cleanly in your personal inbox.

Let's configure outbound sending verification next.

Step 2: Add Verified Sending Domain in Your Email Provider

Whether you use Kit, Mailchimp, or Resend, the verification process is identical:

1. In your email provider's settings, find Sending Domains or Verified Domains.
2. Enter your root domain (e.g. danywalls.com).
3. Your provider will generate 3 CNAME records containing your unique DKIM public keys.

Step 3: The Critical Gotcha with Cloudflare DNS (Gray Cloud vs. Orange Cloud) ⚠️

When copying these CNAME records into Cloudflare DNS, there is one critical step developers frequently miss:

[!IMPORTANT] Disable the Orange Cloud (Proxy) for all DKIM CNAME records. Set them to DNS Only (Gray Cloud). If the Cloudflare proxy is active, Cloudflare intercepts DNS requests and returns its own proxy IPs, preventing your email provider from verifying the DKIM keys.

Type: CNAME
Name: kit1._domainkey.danywalls.com
Target: dkim.kit-verify.com
Proxy status: DNS only (Gray Cloud) ☁️

Once saved, DNS propagation takes 2 to 5 minutes.

Step 4: Add DMARC Record for Safe Policy Enforcement

To satisfy Google and Yahoo's requirements completely, add a simple TXT record for DMARC:

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@danywalls.com;

A policy of p=none allows you to monitor deliverability without risking legitimate emails being rejected while you test.

Let's test the result.

4. Verifying Deliverability and Inbox Placement 📬

Once your domain shows as Verified in your email dashboard:

1. Update your Default Sender Email to hola@danywalls.com.
2. Send a test broadcast to a personal Gmail and Yahoo account.
3. Open the email in Gmail, click the three dots (⋮), and select "Show Original".
4. Confirm that SPF, DKIM, and DMARC all display green PASS badges.

Your emails will now consistently land in the Primary Inbox rather than the Spam or Promotions tab.

Recap 💡

Email deliverability is invisible technical debt: you rarely notice it until subscriber engagement drops.

• Sending newsletters from @gmail.com fails modern DMARC authentication.
• Cloudflare Email Routing provides free inbound forwarding directly to your personal mailbox.
• DKIM CNAME records must be set to DNS Only (Gray Cloud) in Cloudflare to verify successfully.
• Adding a DMARC TXT record ensures compliance with Google and Yahoo inbox rules.

If you are looking to optimize your cloud hosting and developer setup, check out my guide on Migrating Next.js from Vercel to Google Cloud Run and Improving Your Cloud Skills as a Frontend Developer!

Happy writing and coding!