Why Your Business Emails Land in Spam (and How to Fix It)

What you will need: The name of your business domain (the part after the @ in your email address, like "yourbusiness.com") and a way to contact whoever manages your email or website hosting.

Want to see where your own domain stands? Run our free Email Setup Check. Enter your domain and we'll show you, in plain English, what's in place and what's missing.

---

The short version

Email systems like Gmail and Yahoo are suspicious by default. If they can't confirm that a message really came from you, they may send it to spam or reject it. Three settings, called SPF, DKIM, and DMARC, are how you prove it. They are set up once, usually by your domain or email provider, and they make a big difference.

Step 1: Find out if you have a problem

Look for these signs:

1. Customers tell you your emails went to spam. Even one or two reports is worth taking seriously.
2. You get bounce messages. A bounce message (sometimes called a "delivery failure" notice) is an automatic reply saying your email didn't go through. Look for phrases like "message blocked," "rejected," or "failed SPF/DKIM/DMARC."
3. Replies have dried up. If quotes, invoices, or newsletters that used to get answers now get silence, spam folders may be the reason.
4. Send yourself a test. Email a personal account at a different provider (a Gmail or Yahoo address, for example) and check whether it arrives in the inbox or in spam.

Step 2: Understand the three records

These are all DNS records. DNS is the internet's address book, and a DNS record is a short entry in it that tells the world how your domain works. Each of the three records proves something different about your email.

SPF: "Is this sender allowed to send for this business?" Think of it as a guest list at the door. SPF is a list of the servers and services (your email provider, your newsletter tool, your invoicing software) that are allowed to send email using your domain name. If a message comes from somewhere not on the list, the receiving system gets suspicious.

DKIM: "Was this message tampered with?" Think of it as a tamper-proof seal on an envelope. DKIM adds a hidden digital signature to each email you send. The receiving system checks the signature against a matching key published in your DNS. If the seal checks out, the message really came from you and wasn't changed along the way.

DMARC: "What should happen if a message fails the checks?" Think of it as your instructions to the doorman. DMARC tells receiving systems what to do with email that claims to be from you but fails SPF or DKIM: let it through, treat it as suspicious, or block it. It can also send you reports showing who is sending email in your name.

In plain English, all three exist to prove the email is really from you.

Step 3: Check your domain with a free online tool

You don't need to be technical to do this.

1. Open a web search and look for a free email authentication checker (also called an "SPF, DKIM, and DMARC lookup" or "DNS lookup" tool). Pick one that doesn't require you to create an account.
2. Type in your domain name only (for example, "yourbusiness.com"), not a full email address.
3. Run the SPF check and the DMARC check. Both usually work with just your domain.
4. For DKIM, the tool may ask for a "selector." A selector is a label that identifies which signing key to look up, and it differs by email provider. Your provider's help pages or support team can tell you yours.
5. Read the results. Most tools show:
   • Pass / found / valid: The record exists and looks correct.
   • Not found / missing: You don't have this record. This is a likely cause of your problem.
   • Warning / error / multiple records: Something is set up incorrectly. A domain should have only one SPF record. Two can cause failures.

Write down which of the three come back missing or flagged. You'll need that for Step 5.

Step 4: Know what Google and Yahoo now expect

Google (Gmail) and Yahoo have tightened their rules for incoming email. In general:

• All senders should have SPF or DKIM set up.
• "Bulk senders" are expected to have SPF, DKIM, and DMARC all in place. "Bulk" means a high daily volume of email to Gmail or Yahoo addresses, and the providers define it with a specific number. Check Google's and Yahoo's current sender guidelines for that number rather than guessing. If you're not sure whether you count, it's safest to act as though you do.
• Marketing and newsletter emails should include an easy way to unsubscribe, and unsubscribe requests should be honored promptly.
• Spam complaints should stay very low. Google asks senders to keep the spam rate shown in its Postmaster Tools below 0.1%, and never let it reach 0.3%. That's roughly 1 complaint per 1,000 emails. Above that, your messages are much more likely to land in spam.

Even if you send only a few emails a day, setting up all three records is a smart move, because it's what receiving systems look for.

Step 5: Ask your provider to add the three records

Contact whoever manages your domain or email (your email host, website host, or domain registrar) and ask them to set up:

1. An SPF record that lists every service that sends email for your business. Tell them about all of them: your main email, newsletter tool, online invoicing, appointment reminders, and so on.
2. DKIM signing turned on for your domain, with the matching record added to your DNS.
3. A DMARC record. It's common to start in "monitor only" mode (often written as p=none), which collects reports without blocking anything. Once you're confident legitimate email is passing, you can move to a stricter setting.

A note on where to find these settings yourself: If you'd rather do it yourself, the menus differ by provider.

Microsoft 365: DKIM is turned on in the Microsoft Defender portal (security.microsoft.com): go to Email & collaboration > Policies & rules > Threat policies > Email authentication settings, then open the DKIM tab and select your domain. Microsoft shows you two CNAME records to add. Add them at your DNS host (where your domain's DNS is managed, often your registrar), wait for them to take effect, then come back and turn on "Sign messages for this domain with DKIM signatures."

Google Workspace: In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Authenticate email. Select your domain and click "Start authentication." You'll need super admin access.

Your domain registrar (GoDaddy, Namecheap, Ionos, etc.): Sign in, find your domain, and open its DNS settings. It's usually labeled "DNS," "Manage DNS," or "DNS Records." If you can't find it, search your registrar's help for "edit DNS records."

Changes to DNS records can take time to show up: often within an hour, but up to 48 hours. Once they do, re-run the free lookup tool from Step 3 and confirm all three now show as found and valid.

What NOT to do

• Don't buy email lists. People on a purchased list never agreed to hear from you. They're far more likely to mark your messages as spam, and that hurts delivery for all your email, including messages to real customers.
• Don't send business email from a free Gmail address. You can't set up SPF, DKIM, and DMARC for a domain you don't own, and a free address looks less established to customers. Use an address at your own domain (like name@yourbusiness.com).
• Don't add multiple SPF records or paste in records you found online without checking them. A wrong record can make things worse.
• Don't ignore bounce messages. They often say exactly what's wrong.
• Don't jump straight to the strictest DMARC setting. Doing so before everything is set up correctly can cause your own legitimate email to be blocked.

Quick checklist

• Tested by sending to a different provider's address
• Ran SPF, DKIM, and DMARC through a free lookup tool
• Listed every service that sends email for your business
• Asked your provider to add or fix all three records
• Re-checked with the lookup tool afterward
• Confirmed marketing emails include an unsubscribe link

---

Still landing in spam? Get in touch.