Why your business emails go to spam
It is almost never the words. It is three DNS records — SPF, DKIM and DMARC — and until they are right, mail from your own domain looks forged.
You send a quote from you@yourcompany.com and it lands in the client’s junk folder. You rewrite it. You remove the word “free”. You take out the attachment. It happens again.
The words are almost never the problem. The problem is that the receiving server has no way to tell your email apart from someone pretending to be you — and when it cannot tell, it assumes the worst. Fixing that is three DNS records, and once they are right most of these problems stop.
The thing nobody explains about email
Email was designed in an era when everyone on the network was trusted, so the “From” address is just text. Anybody can type anything into it. There is nothing in the original design that stops a stranger sending mail that claims to be from your domain, and for decades nothing did.
Three standards were bolted on afterwards to fix that, and every one of them lives in your domain’s DNS rather than in your mailbox:
- SPF says which servers are allowed to send mail for your domain.
- DKIM puts a cryptographic signature on each message so the receiver can check it was not altered and did come from you.
- DMARC ties the two together, tells receivers what to do when a message fails, and — the part people miss — asks them to report back.
Until all three exist, a receiving server looking at your email sees an unauthenticated message claiming to be from a domain that has published no policy about who may send for it. That is exactly what a forgery looks like. The spam folder is a reasonable response.
SPF: who is allowed to send
SPF is one DNS TXT record listing every service that sends mail as you. Not just your mailbox provider — everything. Your Google Workspace or Microsoft 365, plus your website’s contact form, your invoicing software, your newsletter tool, your CRM.
Two mistakes account for most broken SPF records.
Forgetting a sender. The website sends its contact form notifications through one service and nobody adds it, so half your mail authenticates and half does not. If you cannot list every system that sends mail as you, that is the first thing to go and find out.
More than one SPF record. A domain may have exactly one. Two records is not “both apply” — it is a permanent error, and everything fails. This happens constantly, because each new service tells you to “add this record” and somebody does exactly that. Additional senders go into the existing record, not beside it.
There is also a limit of ten DNS lookups per record, which sounds generous and is not: each include: of a large provider can consume several. Go over and the record fails.
DKIM: proof it was really you
DKIM signs each outgoing message with a private key held by your mail provider, and publishes the matching public key in your DNS. The receiver checks the signature. If it verifies, the message genuinely came from a system holding your key and was not modified on the way.
Your provider generates this for you — in Google Workspace and Microsoft 365 it is a few clicks and a record to paste. The common failure is generating it and never enabling it, or enabling it for the main domain and forgetting the others you also send from.
DKIM matters more than SPF in one specific way: SPF breaks when mail is forwarded, because the forwarding server is not on your list. DKIM survives forwarding, because the signature travels with the message. A great many mysterious delivery problems are forwarded mail with SPF-only authentication.
DMARC: the one that is usually missing
DMARC is where it comes together, and it is the record most small businesses do not have at all. It does two things:
It tells receivers what to do with mail that fails. Three policies: p=none (do nothing, just tell me), p=quarantine (junk it), p=reject (refuse it outright).
It gets you reports. With a reporting address in the record, you receive daily summaries of who is sending mail as your domain and whether it passed. That is the only way to find out that your invoicing tool has been failing authentication for eight months, or that somebody is spoofing you.
Do not start at p=reject. Start at p=none, read the reports for a few weeks until every legitimate sender is passing, and only then tighten. Going straight to reject with an incomplete SPF record is how a business stops its own invoices from being delivered.
This is no longer optional in practice. The large mailbox providers now require authentication from anyone sending in volume, and the direction of travel is clearly toward requiring it from everyone.
The other reasons, in the order they actually bite
Once authentication is right, the remaining causes are worth checking in this order.
You are sending from a free address. Mail from yourbusiness@gmail.com cannot be authenticated as your business, because it is not your domain. It also tells the recipient something you would rather it did not. If you own a domain, send from it.
Your domain is brand new. A domain with no sending history has no reputation, and reputation is what earns the inbox. Sending two hundred cold emails in week one of a new domain is the fastest way to poison it. Ramp up.
Your shared hosting IP is the problem. On cheap shared hosting your website sends mail from an IP address shared with hundreds of strangers, and you inherit their reputation. This is why website mail should go through a proper sending service rather than the server’s own mail() function — which is also, incidentally, unauthenticated.
The contact form emails as the visitor. A very common setup: the form sends with the visitor’s address in the From field so you can hit reply. That is your server claiming to be Gmail, which fails every check there is. Send as your own address and put the visitor’s in Reply-To.
Content, last. Yes, an email that is one big image with a link and the word “URGENT” three times will struggle. But content filtering is the final layer, not the first — and if authentication is broken, no amount of rewriting will save you.
How to check in five minutes
You do not need a specialist for the diagnosis.
- Send an email to a Gmail address you control. Open it, use “Show original”, and look at the three lines at the top: SPF, DKIM, DMARC. Each says PASS or FAIL. That is the whole answer.
- Look up your own records. Any DNS lookup tool will show what
TXTrecords exist on your domain and on_dmarc.yourdomain.com. Two SPF records, or no DMARC record, are both visible in seconds. - Check every system that sends as you, not just your mailbox. The invoicing tool is usually the one nobody thought about.
If SPF, DKIM and DMARC all say PASS and mail still lands in junk, then it is reputation or content and the fix is different. But check the three lines first, because in our experience it is nearly always one of them.
We set this up as part of building a site, because a contact form that delivers into a spam folder is a contact form that does not work. If your mail is going astray and you would rather someone just fixed it, tell us what is happening — the diagnosis is usually quicker than the conversation about it.
Written by Ahsan “Max” Faraz, Maxverse Lab — Karachi
