Why your business emails land in spam: SPF, DKIM and DMARC

You send a quote on Monday and hear nothing back. On Thursday you ring the customer, and they find your email sitting in their junk folder beside the parcel scams. Nothing about the quote was wrong. Their mail provider looked at the message, could not confirm it came from you, and filed it with the strangers.

That decision rests on three records in your domain’s settings, called SPF, DKIM and DMARC. The names are unhelpful, so this post explains each one by what it proves.

Why Gmail doubts you in the first place

Anybody can write your email address in the “From” line of a message. The email system was built in the 1980s on trust, and nothing in the original design stops a stranger in another country sending mail that claims to be from accounts@yourbusiness.co.uk. That is how most invoice fraud starts.

So Gmail, Outlook and the rest look for proof. In early 2024 Google and Yahoo started requiring it from anybody sending in volume, Microsoft followed for Outlook addresses in 2025, and the smaller providers copy whatever those three do. Mail without the proof gets a lower score, and a low score means the junk folder or a quiet rejection. You will rarely get a bounce telling you so.

SPF: which servers may send for you

SPF is a list, published in your domain settings, of the servers allowed to send email that claims to come from your domain. When a message arrives, the receiving server checks where it came from against that list.

If you use Microsoft 365, your SPF record names Microsoft. If you use Google Workspace, it names Google. The trouble starts with everything else that sends as you, which is the next section.

Two common faults: a domain with two separate SPF records, which counts as broken and fails every check, and a record that names a service you stopped using years ago, which lets that company’s servers vouch for you. Your domain gets one SPF record, and everything that sends for you goes into it.

DKIM: a signature the message carries with it

SPF checks where a message came from. DKIM checks the message itself. The service sending your mail adds a digital signature to every message, and your domain settings hold the matching key that lets anybody confirm the signature is real and the message was not altered on the way.

DKIM matters because SPF breaks easily. A message forwarded from one mailbox to another arrives from a server that is not on your list, and fails SPF through no fault of yours. The DKIM signature travels inside the message, so it survives the trip.

Each sending service has its own DKIM key, and you add it by copying a record they give you into your domain settings. Microsoft 365 and Google Workspace both ship with DKIM switched off for your own domain until somebody does this, and on a small business account that set itself up years ago, the step is often missing.

DMARC: what to do when the proof fails

DMARC ties the other two together. It tells receiving servers two things: the address in the “From” line has to match a domain that passed SPF or DKIM, and a message that fails should be handled in the way you have chosen.

The second part is your choice, and there are three settings:

• none means deliver it as normal, but send me a report.
• quarantine means put it in junk.
• reject means refuse it outright.

The reports are the useful part. Gmail, Microsoft and the others send a daily summary to an address you choose, listing every server that sent mail claiming to be from your domain and whether it passed. That is how you find the invoicing tool nobody remembered, and how you spot somebody else sending as you.

Your contact form and your invoices count too

Most businesses think of email as the mailboxes in Outlook. Your domain sends far more than that.

The contact form on your website sends a message to you, often “from” your own address, from your web server. That server is not Microsoft or Google, so unless something authorises it, the message fails every check and lands in your own junk folder. We wrote about contact forms that stop sending separately, because it is the most common version of this problem we see.

Invoices and statements from your accounts package often go out with your address as the sender, sent from the software company’s servers. The same goes for newsletters, booking confirmations, online shop order emails and the review requests some systems send after a job. Each one is a different company sending as you, and each needs adding to your SPF record and given its own DKIM record, or its mail fails.

The test is simple to state: if a customer receives an email with your domain after the @ sign, whatever sent it needs to be on the list.

How to check yours in five minutes

You do not need any special tools for the first look.

1. Send yourself a test. From your work address, send a message to a personal Gmail account.
2. Open the full header. In Gmail, open the message, click the three dots beside the reply arrow and choose “Show original”.
3. Read the top three lines. Gmail prints SPF, DKIM and DMARC with a result beside each. You want PASS on all three.

Then repeat it for the other things that send as you. Send yourself an invoice from your accounts package, submit your own contact form, book yourself an appointment. A pass from Outlook and a fail from the invoicing tool is the most common result, and it explains why customers say they never got the invoice.

If you would rather see the records themselves, free lookup tools such as MXToolbox will show your SPF and DMARC records when you type in your domain. A missing DMARC record shows up straight away.

A sensible DMARC policy to start with

Do not start with reject. If you have a sending service you have forgotten about, a strict policy will block its mail from day one, and you will find out from customers.

Start with none, and send the reports somewhere you will read them. A starting record looks like this, added as a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.co.uk

Leave it for a month. The raw reports are hard to read, so use one of the free report services that turn them into a list of senders. Fix anything legitimate that fails by adding it to SPF and setting up its DKIM record. Once a month of reports shows only your own services, and all of them passing, move to quarantine, then a month later to reject. At that point nobody can send convincing mail as your business, and your own mail carries the strongest proof a receiving server can ask for.

The short version

SPF lists which servers may send as you. DKIM signs each message so it can be checked. DMARC makes the “From” address match, tells the world what to do with failures, and reports back. Your contact form, your accounts package and your newsletter tool all send as you, so all of them need to be included. Check with a test message to Gmail and “Show original”, and start DMARC at none before tightening it.

When we take over a site on Care & Hosting, checking these records and routing the contact form through an authenticated service is part of the move. If you would like to know where yours stand first, ask for a free website review and we will tell you which of the three you have.