In this guide
Short answer: business emails go to spam when receiving mail servers cannot confirm that a message genuinely comes from your domain. Setting up three DNS records, SPF, DKIM and DMARC, proves your emails are legitimate. Most deliverability problems come from missing, duplicated or incorrect records, or from website forms that send mail through an unauthorised server.
You send an important quote, and the customer never sees it. It is in their spam folder, if you are lucky. For small businesses, the cause is usually not the wording of the email. It is the way the domain is set up behind the scenes.
Why email providers are suspicious
Anyone can pretend to send an email from your address. Criminals do it constantly. To protect their users, Gmail, Outlook and others check whether the message really came from a source your domain has approved. If they cannot tell, they may send it to spam or reject it. Since 2024, Google and Yahoo have required authentication for bulk senders, and the same checks influence how everyone’s email is treated.
The three checks
SPF: who is allowed to send
SPF is a record in your domain’s DNS that lists the servers and services allowed to send email on your behalf, such as Google Workspace, Microsoft 365, your website host and your invoicing software. If a message comes from somewhere not on the list, it fails.
DKIM: a signature that cannot be forged
DKIM adds a digital signature to every outgoing message. The matching public key is published in your DNS, so the receiver can confirm the message was not altered and came from an authorised system.
DMARC: the rule for failures
DMARC tells receiving servers what to do when SPF or DKIM checks fail: nothing, send to spam, or reject. It also asks them to send you reports, so you can see who is sending email in your name.
| Record | Where it lives | What it does |
|---|---|---|
| SPF | A TXT record on your domain | Lists approved senders |
| DKIM | A TXT record on a selector under your domain | Proves a message is genuine and unaltered |
| DMARC | A TXT record at _dmarc under your domain | Sets the policy and sends reports |
The most common mistakes
- No SPF record at all. Many small business domains have none.
- Two SPF records. This is invalid, and it makes SPF fail.
- Forgetting a sender. A newsletter tool, CRM or booking system that sends in your name but is not listed.
- Too many lookups. SPF allows at most 10 DNS lookups, and long lists of services can exceed the limit.
- DKIM not switched on. It is often available in your email service but has to be enabled and published.
- DMARC left at none forever. It collects reports but protects no one.
- Website forms using plain server mail. Contact forms that send via the web server often fail authentication.
How to fix it, step by step
- List every system that sends email as you: your mailbox provider, website, invoicing, marketing and booking tools.
- Publish a single, correct SPF record that includes all of them.
- Enable DKIM in each service and publish the keys it gives you.
- Add a DMARC record starting at p=none with a reporting address.
- Test by sending to an outside mailbox and checking the results.
- Tighten DMARC to quarantine, then reject, once reports show everything passes.
Other things that affect deliverability
- Sending from a free address, such as Gmail, while pretending to be a business.
- Sudden bursts of email from a new domain.
- Poor mailing lists, or no easy way to unsubscribe.
- Shared hosting servers with a poor reputation.
- Spammy subject lines and image-only emails.
Do it once, properly
Email authentication is one of the most valuable fixes for a small business, and it is a one-off job. If you are still choosing a setup, read business email versus Gmail, and choose the right address with our guide to .co.uk versus .com domains. If your site collects enquiries, see privacy policy and cookie rules for UK websites.
HomeIT Services sets up domains, business email and authentication for small businesses across Essex. See domains, websites and email setup, or contact us from Southend-on-Sea, Chelmsford or nearby.
Frequently asked questions
They are three DNS-based checks that prove an email really came from your domain. SPF lists who may send, DKIM adds a digital signature and DMARC tells receivers what to do when a check fails.
No. A domain should have exactly one SPF record. Two records cause errors and failed checks, so combine all senders into one.
Start with p=none to collect reports, then move to quarantine and finally reject once you are sure every legitimate sender passes.
Website forms often send through a server that is not authorised in your SPF record or signed with DKIM. Sending through authenticated SMTP with a proper mail service fixes it.
Send a test message to an external mailbox and look at the message headers, or use a free email checker that reports SPF, DKIM and DMARC results.
Rather have it done properly?
Get a clear, fixed quote from a local engineer before any work starts.