Why your business emails land in spam, and the one-time fix (SPF, DKIM and DMARC in plain English)

If your quotes, invoices and newsletters keep landing in spam or the Promotions tab, the most likely reason is that your domain has never been authenticated: nothing tells Gmail and Outlook which servers are allowed to send email as you. Since 2024 the major mailbox providers require this for anyone sending in volume, and they quietly penalise everyone else. The fix is three DNS records, set once. Here is what each does, in plain English.

SPF: who may send as you

SPF is a single text record on your domain listing every service allowed to send mail from your addresses: your email provider, your website’s mail service, your newsletter tool, your CRM. When a message arrives claiming to be from you, the receiving server checks whether it came from one of those. If the sender is not on the list, the message looks forged.

The common failure: a business adds a newsletter tool or a website form service and never adds it to SPF. Every email that tool sends fails the check. The record has a length limit too — too many services listed and it stops working entirely — so it needs to be kept tidy.

DKIM: proof the message was not altered

DKIM adds a digital signature to each outgoing message, and publishes the matching key in your DNS. The receiving server checks the signature; if it verifies, the message genuinely came from a system holding your key and was not tampered with. Each sending service (Google Workspace, Microsoft 365, Brevo, Klaviyo, Mailchimp) has its own DKIM key, and each has to be added. A service sending without DKIM is a service sending unsigned mail.

DMARC: what to do when checks fail, and tell me about it

DMARC is the policy record. It tells receivers what to do with mail that claims to be from you but fails SPF and DKIM — deliver it anyway, put it in spam, or reject it — and where to send reports about what they saw. Start with the monitoring-only policy (p=none) and read the reports for a month; they show every service sending as your domain, including ones you forgot about. When everything legitimate is passing, tighten to quarantine, then reject. At that point nobody can convincingly impersonate your domain, which protects your customers as well as your deliverability.

Why this matters beyond spam

Every email your website sends — the “we received your enquiry” confirmation, your reply to a customer, a password reset, an order confirmation — goes through the same checks. An unauthenticated domain means your customers do not get your replies and you do not know it. We have seen businesses lose weeks of leads this way, blaming the form when the problem was DNS.

The things that quietly break it

Sending from a Gmail account with a “send as” alias for your business address: it works, but the mail is signed by Gmail’s key, not yours, so it can never fully pass DMARC alignment. Forwarding services that rewrite headers. A website that sends mail directly from its own server with no authentication at all, which is the WordPress default. Each is fixable, but each needs to be known about.

What we do

Domain authentication — SPF, DKIM and DMARC set up correctly for every service you send from, and your website’s mail routed through an authenticated provider — is part of every email marketing setup we do, from $499. It is also the first thing we check when a client says “our contact form doesn’t work”, because half the time it does; the replies just never arrive.