Why your emails end up in spam.

Short answer: three DNS records decide whether the big mailbox providers trust email from your domain: SPF, DKIM and DMARC. Since 2024, Google and Yahoo require this authentication, and Microsoft followed. Most small businesses have never set the records up, or set them up once and broke them since. The result is quotes and invoices that quietly land in junk. The fix is a morning of careful DNS work, and this page explains it in plain English.

The cost nobody sees

When a quote lands in spam, nothing tells you. The customer thinks you never answered. You think they went with someone else. Both of you are wrong, and the job goes to whoever’s email arrived.

We see this most with the businesses that can least afford it: trades and contractors quoting new customers. A first-time customer’s mail provider has never seen your domain before. If your records are missing, junk is the default, not the exception.

There is a second cost, and it is worse. Without these records, anyone can send email that appears to come from your domain. Criminals use that for fake invoices: your name, your look, their bank details. Customers have wired real money to fraudsters over exactly this. The records that keep you out of spam are the same ones that make you hard to impersonate.

The three records, in plain English

SPF is a public list of the servers allowed to send mail for your domain. A message from a server that is not on the list looks suspicious to whoever receives it. Most businesses send from more places than they think: Microsoft 365, the website contact form, QuickBooks, a newsletter tool, field-service software. Every one of them has to be on the list.

DKIM is a cryptographic signature added to each message. It proves the mail came from an authorized system and was not altered on the way. Think of it as a tamper-evident seal.

DMARC is the instruction sheet. It tells receiving servers what to do with a message that fails the first two checks: deliver it anyway, quarantine it, or reject it. It also sends you reports, which is how you find out who is sending as you, legitimate and otherwise.

Why this stopped being optional

For years these records were a nice-to-have. In February 2024, Google and Yahoo began requiring authentication, and mail that fails their checks is now filtered or refused outright. Microsoft followed in 2025 with requirements of its own.

The rules are strictest for bulk senders, but the direction is the same for everyone: unauthenticated email is treated as suspect by default. A domain with no records is competing for the inbox with one hand tied behind its back.

How to fix it without breaking Tuesday’s invoices

First, inventory. List every system that sends email as your domain. This is the step people skip, and it is why quick fixes break things.

Publish one SPF record that covers everything on the list. Exactly one. A domain with two SPF records has, as far as receivers are concerned, none. It is the most common mistake we find.

Turn on DKIM for each sender, starting with your main mail system. In Microsoft 365 this is a setting, not a project.

Add DMARC gently. Start in monitor-only mode, read the reports for a few weeks, then tighten to quarantine and finally to reject once nothing legitimate is failing. Businesses that jump straight to a strict policy discover their invoicing software the hard way, when a week of invoices goes nowhere.

Where you stand right now

Checking takes minutes with the right tools, and it is literally on our checklist: email authentication records are one of the fifteen points in our free IT health check. If you would rather just know than wonder, ask.