Why your business emails go to spam, and how to fix SPF, DKIM and DMARC

Business emails usually land in spam because the receiving mail service can’t confirm they really came from you. Three DNS records prove that: SPF lists the servers allowed to send as your domain, DKIM adds a signature that shows the email wasn’t altered, and DMARC tells receivers what to do when a message fails those checks. Gmail and Yahoo now expect every sender to have at least SPF or DKIM. Set all three up for every tool that sends as your domain, and most “it went to junk” problems go away.

The tricky part isn’t the records themselves. It’s that your business probably sends email from more places than you realise, and each one needs to be covered. This guide walks through finding them, checking your domain, and fixing things in an order that won’t stop your email altogether.

Every tool that sends email as your business

When a quote goes out from your accounting software “from” accounts@yourbusiness.com.au, it isn’t sent by your email provider. It’s sent by the accounting software’s servers, using your address. To Gmail or Outlook, that looks identical to a scammer using your address, unless your DNS records say that tool is allowed.

Make a list. For a typical small business it includes:

• Your mailbox provider, such as Microsoft 365 or Google Workspace.
• Your website, which sends form notifications and sometimes order confirmations.
• Invoicing and accounting software, sending quotes, invoices and reminders.
• Your CRM, sending follow-ups and automated sequences.
• Newsletter or marketing tools.
• Booking, job management or point-of-sale systems that send confirmations and receipts.
• Anything else that sends “from” your domain: a phone system emailing voicemails, a quoting tool, a survey tool.

For each one, write down which address it sends from. If a tool sends from its own domain (for example, noreply@sometool.com) rather than yours, it doesn’t need your records, but your customers are also more likely to ignore it.

SPF, DKIM and DMARC in plain English

SPF: the guest list

SPF (Sender Policy Framework) is a single text record in your domain’s DNS that lists the servers allowed to send email for your domain. Each tool you use gives you a line to add, usually an “include”. The SPF standard, RFC 7208, has two rules that trip people up: a domain must have only one SPF record, and checking it can involve no more than 10 DNS lookups. Break either rule and the check returns an error, which can count as a fail.

DKIM: the signature

DKIM (DomainKeys Identified Mail) has each sending service sign your emails with a private key. You publish the matching public key in your DNS, and receivers use it to check the signature. Each tool gives you its own DKIM record, so you’ll usually have several.

DMARC: the instructions

DMARC ties the two together. It checks that the domain in the “From” address lines up with the domain that passed SPF or DKIM, tells receivers what to do with mail that fails (nothing, junk it, or reject it), and asks them to send you reports. The policy is set with p=none, p=quarantine or p=reject.

What the big mailbox providers now expect

Google’s sender guidelines require everyone sending to personal Gmail accounts to set up SPF or DKIM. Senders of more than 5,000 messages a day to Gmail must have SPF, DKIM and DMARC, with the From domain aligned, plus one-click unsubscribe on marketing email. Yahoo’s sender requirements are similar, and both ask senders to keep spam complaint rates below 0.3%. Most small businesses aren’t bulk senders, but meeting the bulk standard costs little and removes the guesswork.

In Australia, the Australian Signals Directorate’s guidance on how to combat fake emails recommends all three controls and says to implement DMARC immediately, even if only in monitoring mode (p=none). It’s written for organisations of any size and is worth reading if you want the detail.

How to check your domain in five minutes

1. Send yourself a test. From each tool on your list, send an email to a personal Gmail address.
2. Read the results. In Gmail, open the message, click the three-dot menu and choose “Show original”. You’ll see SPF, DKIM and DMARC listed as PASS or FAIL.
3. Look up your records. Use any free DNS lookup tool to view the TXT records for your domain. Look for one record starting with v=spf1, and a record at _dmarc.yourdomain starting with v=DMARC1.
4. Count your SPF records. If there are two lines starting with v=spf1, that’s a problem to fix first.
5. Note what fails. A tool that shows FAIL for both SPF and DKIM needs setting up.

Repeat the test from your website’s contact form. That’s the one most often missed.

Fixing it in a safe order (and the mistakes that stop email entirely)

Changes to these records affect every email your business sends, so work in this order.

1. Get access to your DNS, usually at your domain registrar or hosting provider. Take a screenshot or export of the current records before you change anything.
2. Merge SPF into one record. Combine every tool’s include into a single v=spf1 line. Remove includes for tools you no longer use.
3. Turn on DKIM in each tool. Each one will give you the records to add and a button to verify them.
4. Publish DMARC at p=none with a reporting address. This changes nothing about delivery; it just starts the reports.
5. Read the reports for a few weeks. They show every service sending as your domain and whether it passes. You’ll often find a tool you forgot.
6. Tighten gradually. Once every legitimate sender passes, move to p=quarantine, then later to p=reject if you want the strongest protection against people faking your address.

The mistakes that cause real damage:

• Adding a second SPF record for a new tool instead of editing the existing one.
• Going past 10 DNS lookups by stacking includes for every tool you’ve ever tried.
• Jumping straight to p=reject before checking reports, which blocks every sender you haven’t covered, including your own invoices.
• Changing mailbox provider or hosting and leaving the old records behind, or losing them in the move. Our guide on moving to new hosting without losing email covers this.

Website form emails: the most common culprit

Many websites send form notifications straight from the web server, with no SPF or DKIM coverage. Worse, some forms are set to send “from” the customer’s own email address so you can hit reply. To Gmail, that’s your web server pretending to be someone else’s domain, and it fails.

The fix:

• Send form emails through an authenticated email service (SMTP or a transactional email service), not the server’s built-in mail function.
• Send from an address on your own domain, such as website@yourbusiness.com.au, with that service covered by your SPF and DKIM.
• Put the customer’s email in the Reply-To field, so replying still goes to them.
• Store submissions somewhere other than email too, such as your CRM, so a lost notification doesn’t mean a lost enquiry.

If your enquiries already flow into a CRM or trigger follow-ups, the same rules apply to those messages. Our automation work includes setting up sending properly so automated emails actually arrive.

Keeping it working when you add a new tool

Most email problems start months after the records were set up correctly, when someone signs up for a new tool and starts sending from the business address. Build a habit:

• Before any new tool sends as your domain, add its SPF include and DKIM records, and check you’re still under 10 lookups.
• When you stop using a tool, remove its records.
• Keep a short list of every sending tool and who manages the DNS.
• Look over your DMARC reports, or a summary of them, every month or two.

Authentication gets your email delivered. What you send still has rules: if a new tool is for marketing, read up on the rules for marketing texts and emails before the first campaign.

Where to start

1. List every tool that sends email from your domain.
2. Send a test from each one to Gmail and check SPF, DKIM and DMARC in “Show original”.
3. Back up your current DNS records.
4. Merge SPF into a single record and turn on DKIM for each tool.
5. Publish DMARC at p=none and read the reports for a few weeks.
6. Fix your website form so it sends through an authenticated service.
7. Move to quarantine, then reject, once everything passes.

If you’d rather hand this over, it’s part of our managed hosting and email setup. We’ll find every sender, fix the records in a safe order and keep an eye on the reports.