Few things are more frustrating than sending a quote or an invoice and hearing a week later that it was never seen. It was probably sitting in a spam folder. Business email goes to spam for a small number of well-understood reasons, and most of them are fixed in DNS in an afternoon.
What mail providers are checking
When your email reaches a receiving server, it asks a simple question: is this message really from the domain it claims, and was it sent by someone allowed to send for that domain? Three records on your domain answer that question.
SPF: who is allowed to send
SPF is a list, published in DNS, of the servers and services allowed to send email for your domain. If you send from your mail provider, your website contact form, an invoicing tool and a newsletter service, each of them needs to be on the list.
DKIM: proof the message was not altered
DKIM adds a digital signature to each outgoing message. The receiver checks it against a public key in your DNS. A valid signature shows the message came from a system that holds your private key and was not changed on the way.
DMARC: what to do when checks fail
DMARC ties the two together. It tells receivers what to do with mail that fails SPF and DKIM, and it asks them to send you reports. Without it, receivers guess, and often guess badly.
The mistakes that send mail to spam
- No records at all. A domain with no SPF, DKIM or DMARC looks the same as one that is being forged.
- More than one SPF record. A domain can have only one. Two records, usually added by two different people, make both invalid. Combine them into one.
- Too many lookups. SPF allows a limited number of lookups. Adding every service you have ever tried can push it over, and the whole record fails.
- A service sending as you without being listed. Contact forms, online shops, invoicing and newsletter tools all send email that appears to come from your domain. Each needs to be authorised.
- A strict policy set too early. Moving DMARC straight to reject before every legitimate sender is accounted for can block your own email.
- Sending from a free address through your own system. A message from a free webmail address, sent by a server that is not that provider, fails authentication by design.
The order to fix things in
- List every sender. Your mail provider, website forms, invoicing, newsletters, booking systems and anything else that sends as your domain.
- Publish one SPF record that covers all of them.
- Switch on DKIM for your mail provider and for each service that supports it.
- Add DMARC in monitoring mode with a reporting address, so you can see who is sending as your domain.
- Read the reports for a few weeks and fix anything legitimate that is failing.
- Tighten the policy step by step, once everything that should pass does pass.
Other causes worth ruling out
- A sudden increase in volume from a new list or system.
- Messages that are mostly images or contain only a link.
- A mismatch between the visible “from” name and the real sending address.
- Your sending address or server appearing on a blocklist.
- A compromised mailbox or website form sending spam without you knowing.
How to check your own domain
Send a test message to a few different addresses and look at the message headers, which show whether SPF, DKIM and DMARC passed. Or let us do it: our free website health check reads your SPF and DMARC records and flags what is missing.
Want it sorted for you?
Email set-up is part of our website and IT management service, and small deliverability jobs are usually a fixed price. Ask for a free site review, request a call or email [email protected].
