Why your business emails land in spam, and the three records that fix it

A client calls to say their quotes are not reaching customers. The website contact form "stopped working". Invoices sent from the accounting system never arrive. In most of these cases nothing is broken at all. The emails are being sent fine. They are just landing in the spam folder, or being quietly rejected, because the receiving mail server cannot prove they really came from you.

Since early 2024, Gmail, Yahoo and Outlook have all tightened the rules for who gets into the inbox. Mail that used to slip through now gets filtered. The good news is that the fix is usually three small DNS records that take less than an hour to set up.

Why the receiving server does not trust you

Email was designed in a time when everyone trusted everyone. Anyone can send a message that says it is from [email protected], the same way anyone can write your return address on an envelope. Scammers use exactly this to send fake invoices and payment requests in your name.

So today, when an email arrives, Gmail and Outlook ask three questions before deciding where it goes:

• Is this server allowed to send mail for this domain?
• Was the message changed on the way here?
• If either check fails, what does the domain owner want us to do?

Each question is answered by one DNS record: SPF, DKIM and DMARC.

1. SPF: the list of who may send for you

SPF is a single TXT record on your domain that lists every server allowed to send email as you. Your mail host, your website server, your newsletter tool, your invoicing system. If a message comes from a server that is not on the list, it fails.

v=spf1 a mx include:_spf.google.com ~all

The mistake we see most often is not a missing SPF record, it is an incomplete one. The business moved to a new email provider, or started sending invoices from a billing app, and nobody added the new sender to the list. Another common one: two separate SPF records on the same domain. You are only allowed one, and having two makes both fail.

2. DKIM: a tamper seal on every message

DKIM adds a digital signature to every email you send. Your mail server signs the message with a private key, and publishes the matching public key in DNS. The receiving server checks the signature. If it matches, it knows the message really came from your domain and was not changed in transit.

Your email provider generates the DKIM key for you. Your job is only to copy the record they give you into your DNS. If you send from more than one system, each one needs its own DKIM key.

3. DMARC: your instructions for failures

DMARC ties the first two together and tells receiving servers what to do when a message fails. It also sends you reports, so you can see who is sending mail using your domain, including anyone pretending to be you.

v=DMARC1; p=none; rua=mailto:[email protected]

Start with p=none, which only monitors. Read the reports for a few weeks to make sure every real sender passes. Then move to p=quarantine (failures go to spam) and finally p=reject (failures are refused). Jumping straight to reject on day one is how businesses accidentally block their own invoices.

The other reasons mail still goes missing

Even with all three records in place, a few other problems come up again and again in our support work:

• A stale password in the website mail plugin. Someone changes the mailbox password, and the WordPress SMTP plugin keeps using the old one. Every contact form message after that silently fails.
• Sending from a free address. A website form that sends "from" a Gmail address will fail checks, because your server is not allowed to send for gmail.com. Send from your own domain and put the visitor's address in Reply-To instead.
• A blacklisted shared server. On cheap shared hosting, one bad neighbour sending spam can get the whole server's IP address blocked, and your mail goes down with it.
• A missing reverse DNS record. The sending server's IP address should point back to a proper hostname. Many providers reject mail from servers that do not have one.

How to check your own domain today

Send an email from your business address to a personal Gmail account. Open it, click the three dots, and choose "Show original". Near the top you will see three lines: SPF, DKIM and DMARC. Each one should say PASS. If any of them says FAIL, or is missing, your mail is at risk of going to spam, if it is not already.

It takes two minutes, and it is worth doing for every system that sends mail for you: your mailbox, your website forms and your invoicing software.

If you see a FAIL, or you simply want someone to set this up properly, talk to us. We set up and fix email delivery for businesses every week, and we will tell you exactly what was wrong and why.