11 September 2026 · 6 min read My OTP emails passed SPF, DKIM and DMARC, and still went to spam A client's users were finding their login codes in spam, with SPF, DKIM and DMARC all set up. Passing authentication, it turns out, is not passing the filter. Email Cloudflare Ops