Why Your Business Email Goes to Spam (and the Three Records That Fix It)
Quotes that never arrive are usually sitting in a junk folder because three DNS records are missing. What SPF, DKIM and DMARC do, in plain English.
Dollar figures in this article are US dollars. Our Australian prices are on the pricing page.
A customer says they never got your quote. You resend it. They still do not get it. Eventually somebody checks a junk folder and there are four of them.
This is almost never a mystery and almost always the same cause: the receiving mail server cannot verify that your email is genuinely from you, so it treats it the way it treats everything else it cannot verify. Three DNS records fix it. They are not difficult, but they are invisible, so they go unset for years.
Short version. SPF says which servers may send as you. DKIM signs each message so it cannot be tampered with. DMARC tells receivers what to do when the first two fail, and asks them to report back. Missing any of them, your mail is a guess. Since 2024, bulk senders to Gmail and Yahoo need all three.
Why This Got Stricter
Email was designed with no way of proving who sent anything. Anyone can put your address in the "from" field, which is why phishing works. The three records below are the retrofit.
In 2024 Google and Yahoo began requiring authentication for bulk senders, and the practical effect reached far beyond bulk senders: the tolerance for unauthenticated mail from small domains dropped everywhere at once. A great many small businesses experienced this as "our email suddenly stopped arriving", with no change on their side. Nothing broke; the bar moved.
SPF — Who Is Allowed to Send
A single DNS record listing which servers may send email using your domain. When a message arrives, the receiver checks whether the sending server is on that list.
Where it goes wrong:
- More than one SPF record. Absolutely fatal and very common — one gets added for the website host and another for the mail provider. Two records is an automatic fail, worse than none. There must be exactly one, with everything listed inside it.
- Forgetting a sender. Your mail provider, your website's contact form, your invoicing software, your newsletter tool and your CRM may all send as you. Each needs including.
- Too many lookups. SPF permits ten DNS lookups; each service you include may consume several. Exceed it and the record fails entirely.
DKIM — A Signature on Every Message
Your mail server signs each outgoing message cryptographically. The receiver checks the signature against a public key published in your DNS. If it matches, the message genuinely came from you and was not altered in transit.
Where it goes wrong: the key is published but the server is not actually signing, so everything fails while the DNS looks perfect. Enable it at the provider, then verify against a real received message rather than assuming.
We have seen a hosting control panel publish a DKIM key and quietly stop signing for a domain after an unrelated update — the DNS looked immaculate for weeks while every message failed. Check the message, not the dashboard.
DMARC — What to Do When Those Fail
A policy record saying how receivers should treat mail that fails SPF and DKIM, and an address to send reports to. Three settings:
p=none— do nothing, just report. Where you start.p=quarantine— send failures to spam.p=reject— refuse them outright.
Start at p=none with a reporting address and leave it there for a few weeks. The reports will show you every service sending as your domain, including the two you had forgotten. Fix those, then tighten. Jumping straight to p=reject is how a business stops its own invoices from being delivered.
Check Yours in Five Minutes
- Send an email to a Gmail address you control.
- Open it, and choose "Show original".
- Read the top three lines. SPF, DKIM and DMARC each say PASS or FAIL. That is the whole test, and it is authoritative in a way that any checker tool is not, because it is a real message on a real receiver.
- Any FAIL is your answer. Fix that one first.
When the Records Are Right and Mail Still Fails
- Sending from a website form using your own address as the "from". The web server is not an authorized sender, so it fails SPF. The form should send from an address on the server's own domain and set your address as reply-to — this single misconfiguration accounts for an enormous share of "our contact form does not work".
- A shared IP with bad neighbors. Cheap hosting means sharing a sending reputation with whoever else is on it.
- No reverse DNS on your sending IP.
- Content triggers. Far less significant than authentication, but an email that is one large image with a link still looks like a newsletter nobody asked for.
- You are actually on a blocklist. Usually the aftermath of a compromise. Check, and note that delisting is pointless until the cause is fixed.
Whose Job Is This?
It falls between everybody, which is why it goes unfixed. The web developer says it is email. The email provider says it is DNS. Whoever manages DNS says nobody told them.
It belongs to whoever holds your DNS, and it takes about an hour to set up properly once. If your inquiries have quietly declined and nobody can say why, check this before rewriting the website — it is a much cheaper explanation, and it is the sort of thing our hosting and care work covers as standard precisely because it is nobody's job by default.
Common Questions
Why Does My Business Email Go to Spam?
Usually because the receiving server cannot verify the message genuinely came from you. Three DNS records fix this: SPF lists which servers may send as your domain, DKIM cryptographically signs each message, and DMARC tells receivers what to do when those checks fail. Missing any of them, your mail is a guess.
What Are SPF, DKIM and DMARC in Plain English?
SPF is a list of who is allowed to send email using your domain. DKIM is a signature on each message proving it came from you and was not altered. DMARC is a policy telling receiving servers what to do when the first two fail, plus an address for them to report back to.
How Do I Check Whether My Email Authentication Is Working?
Send an email to a Gmail address you control, open it and choose "Show original". The top three lines report SPF, DKIM and DMARC as PASS or FAIL. That is authoritative in a way checker tools are not, because it is a real message assessed by a real receiver.
Can I Have Two SPF Records?
No — and it is one of the most common causes of delivery failure. Two SPF records is an automatic fail, and worse than having none. There must be exactly one record with every sending service listed inside it. SPF also permits only ten DNS lookups, and exceeding that fails the whole record.
Why Does My Website Contact Form Email Go to Spam?
Usually because the form sends using your own address as the "from" while the web server is not an authorized sender for your domain, so SPF fails. The fix is to send from an address on the server's own domain and set your address as reply-to instead.
