Why your business email lands in spam, and the three records that fix it
You bought a domain, set up email, sent a quote to a client, and it landed in spam. The cause is almost never the wording of your message. It is that nothing in your DNS tells the receiving server your mail is genuinely yours.
Why this became urgent
Authentication used to be an advantage. It is now the floor. Google and Yahoo both enforce sender requirements for bulk senders, defined as roughly 5,000 or more messages a day to their consumer addresses: authenticate with SPF and DKIM, publish DMARC, support one-click unsubscribe on marketing mail, and keep spam complaints below 0.3%. Microsoft has since aligned with the same baseline. Read the current text on Google's Email sender guidelines rather than a summary, because the thresholds get tightened over time.
If you send 50 emails a day you are not a bulk sender, and none of the enforcement applies to you directly. It still matters, because filters learned to treat unauthenticated mail as suspect regardless of volume. Small senders inherit the standard without the grace period.
SPF: who is allowed to send
SPF is one DNS TXT record listing the services permitted to send mail using your domain. If you use Google Workspace it is a single include. If you also send invoices from a billing app and campaigns from a newsletter tool, each needs to be in the record.
| Rule | Why |
|---|---|
| Exactly one SPF record per domain | Two records is a permanent error, and both stop working |
| Stay under 10 DNS lookups | Each include: costs lookups; exceeding the limit fails the check |
End with ~all or -all | ~all is soft fail, -all is hard fail. Start soft, tighten later |
| List every sending service | Forgotten services are the usual cause of “only some of our mail bounces” |
The classic failure: SPF breaks when mail is forwarded, because the forwarding server is not in your record. That is exactly why DKIM exists.
DKIM: proof the message was not tampered with
DKIM signs outgoing messages with a private key held by your mail provider and publishes the matching public key in DNS. A receiver verifies the signature and knows the message really came from your domain and was not modified in transit. Unlike SPF, the signature survives most forwarding.
You do not generate DKIM keys by hand. Your provider gives you a selector and a public key to publish; Google Workspace, Zoho, Microsoft 365, and every serious sending platform have a one-page setup for it. The mistake to avoid is enabling DKIM in the provider's console and never publishing the DNS record, or vice versa. Both halves are required.
DMARC: the policy and the visibility
DMARC does two jobs. It states what receivers should do with mail that fails authentication, and it asks them to send you aggregate reports about who is sending as your domain.
- Start at
p=nonewith a reporting address. This changes nothing about delivery and simply turns on visibility. - Read the reports for a few weeks. You will usually discover a legitimate service nobody told you about, still sending unauthenticated.
- Fix those services, then move to
p=quarantine. - Move to
p=rejectonce reports are clean. This is what actually stops someone spoofing your domain to invoice your clients.
Raw DMARC reports are XML and unpleasant to read. Free report-parsing services exist; use one rather than opening the attachments yourself.
Setup order for a small business
- Point your domain's DNS somewhere you control and can edit quickly.
- Set up mail hosting, then publish the provider's SPF include and DKIM key.
- Send a test to an address on a different provider and inspect the headers. Look for
spf=passanddkim=pass. - Publish
v=DMARC1; p=none; rua=mailto:you@yourdomain. - Add every other sending service to SPF and enable DKIM on each one.
- Tighten DMARC to quarantine, then reject.
Things that quietly ruin deliverability
- Sending marketing mail from your main domain. Complaints against a newsletter can damage the reputation your invoices depend on. Consider a subdomain for campaigns.
- Buying or scraping lists. Nothing recovers a domain reputation faster than never damaging it. Consented signups only.
- No unsubscribe, or a broken one. Marketing mail needs a working one-click unsubscribe header, and people who cannot leave will report you as spam instead.
- A brand-new domain sending thousands on day one. Volume should ramp gradually.
- Ignoring bounces. Repeatedly mailing dead addresses is a reputation signal.
How to check your work
Send a message to a Gmail address you control, open it, and use “Show original.” You will see SPF, DKIM, and DMARC results in three lines. That single check catches most misconfiguration. Public authentication testers will do the same against your domain if you prefer a report.
None of this is glamorous, and it is a one-afternoon job that stops your quotes from disappearing into spam folders for years.
No company paid for placement in this article. Verify current prices and terms with each provider before buying.