Why your business emails go to spam, and how to fix it.

Why it happens, in plain words

Gmail, Outlook and Yahoo decide where each message goes by asking three things. Can the sender prove the message came from the domain in the From address? What is that domain's record of past mail? And does this message look like mail people want? For most small businesses the problem is the first question. Some service sends email as your address without the records that prove it is allowed to.

Take a physiotherapy clinic. Emails the owner writes from her mailbox arrive fine. Booking confirmations sent by the booking software, also from an address on the clinic's domain, land in spam for patients with Gmail addresses. The booking tool was never added to the clinic's records, so to Gmail those confirmations look like someone pretending to be the clinic. Patients miss the time, the address and the link to cancel, and some do not turn up.

The fix follows the same order for every business:

• Find which emails land in spam, and with which providers.
• Read the verdict Gmail writes into each message.
• List every service that sends as your domain.
• Fix SPF, then turn on DKIM for each service, then add DMARC.
• Fix the website form if it sends as the customer.
• Then look at what you send and to whom.

Most of this is a few lines in your domain's DNS settings, the place where your domain says where its website and email live. You can do it yourself if you have the login, or hand this guide to whoever manages your domain.

Find out which emails land in spam

Start with a list of every kind of email your business sends. Most owners think of the mail they type and forget the rest:

• Replies and new messages from your own mailbox.
• Form notifications that tell you about a new enquiry.
• The confirmation a customer gets after sending the form.
• Booking confirmations and reminders from your booking tool.
• Quotes, invoices and payment reminders from your accounting software.
• Receipts and order emails from your online store.
• Newsletters and review requests.

Then send a real example of each one to three free addresses you set up for testing: one at Gmail, one at Outlook.com and one at Yahoo. Add a work address at a company if most of your customers are businesses, because company mail often runs through its own filter. Note where each one lands: the inbox, a tab such as Promotions, or spam.

If a customer told you they found your quote in spam, ask which email provider they use. A pattern usually shows quickly: everything from one tool fails, or everything fails at one provider.

Read the verdict in the message

Open one of the test emails in Gmail on a computer, click the three dots next to the reply button and choose Show original. The top of that page lists three checks, each marked PASS or FAIL, with the domain it was checked against:

• SPF checks whether the server that sent the message is on the list your domain publishes. A fail means a service sends for you without being on that list.
• DKIM checks a signature added by the sending service. A pass for a domain that is not yours, such as the booking tool's own domain, means the service signs its mail but has not been set up to sign for your domain.
• DMARC passes only when SPF or DKIM passes for your domain, the one in the From address the customer sees. This is the check the sender rules rest on, so it is the one to get to PASS.

Write the three results down for each kind of email. A booking confirmation with SPF and DKIM passing for the tool's domain and DMARC failing is the usual picture: the tool proves who it is, but not that it may send as you.

Other mail apps show the same lines in the full headers of a message, but Gmail's Show original page is the easiest to read.

List every service that sends as your domain

Your domain is the part of your email address after the @. Every service that sends mail with that domain in the From address has to be allowed by your records, or it fails. For a two-van plumbing firm, the list might be:

• Google Workspace, for the owner's and the office's mailboxes.
• The website, which emails each form enquiry to the office.
• The job management software, which sends quotes, booking confirmations and invoices.
• The accounting software, which sends payment reminders.
• A newsletter tool used twice a year.

For each one, look in its settings for a section called domain authentication, sender authentication or custom sending domain. Most tools that send on your behalf have one, and it gives you two or three records to add to your DNS. Add them, then press the button in the tool that checks them.

The same goes for messages sent by an automation you had built, such as instant replies from enquiry follow-up or reminders from booking automation. Each sends through an email service, and that service needs the same records.

If a tool has no such setting, let it send from its own address with yours as the reply-to address, so replies still reach you. That is better than a message that claims to be from you and fails. And take services you no longer use off the list. An old entry for a newsletter tool you left years ago still lets that tool's servers pass as you.

Fix SPF: one record that names every sender

SPF is a single TXT record at the root of your domain that lists the services allowed to send for it. For a business whose only sender is Google Workspace, Google gives this record:

"v=spf1 include:_spf.google.com ~all"

Each further service gets its own include, copied from that service's help page and placed before the ~all at the end. The ~all tells receiving servers to treat mail from anywhere else as suspicious, and it is the ending Google recommends.

Three mistakes break SPF more often than anything else:

• Two SPF records. The standard allows one per domain, and a second one makes the check fail for every message. When a new tool tells you to add an SPF record, add its include to the record you have instead.
• Too many lookups. SPF stops working when checking the record needs more than ten further DNS lookups, and each include counts, along with any includes inside it. Remove services you no longer use, and where a tool offers DKIM, prefer that to another include.
• A record left behind. After a move to a new mail provider, the old provider's include often stays in the record and the new one is missing.

SPF has a weakness worth knowing. It checks a hidden return address, not the From address customers see. Many tools send with their own return address, so SPF passes for their domain and does nothing for yours. That is why DKIM matters more.

Turn on DKIM for each service

DKIM adds a signature to every message, made with a key only the sending service holds. Your DNS publishes the matching public half, so the receiving server can check that the message came from a service allowed to sign for your domain and was not changed on the way. A DKIM signature also survives forwarding, which SPF does not.

In Google Workspace, a super administrator generates the key in the Admin console, under Apps, Google Workspace, Gmail, Authenticate email. Choose the 2048-bit key if your DNS host accepts it. The page shows a TXT record to add, by default under the name google._domainkey. Add it, then come back and press Start authentication. Google says it can take up to 48 hours for DKIM to start working.

In Microsoft 365, DKIM uses two CNAME records, named selector1._domainkey and selector2._domainkey, with values Microsoft generates for your account. Add both, then switch signing on for your domain in the Microsoft Defender portal. The records do nothing until you do.

For every other tool on your list, the domain authentication setting from the step before is its DKIM setup. When it is done, send another test and open Show original again. DKIM should now pass for your own domain.

Add DMARC, and start by watching

DMARC is one more TXT record, at the name _dmarc in front of your domain. It tells receiving servers what to do with mail that claims to be from you but passes neither SPF nor DKIM for your domain, and where to send daily reports. A first record looks like this:

"v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"

The p=none part means: deliver as usual, but report. Google's advice is to set up SPF and DKIM first, let them run for 48 hours, then add DMARC at none.

The reports come from the big mail providers as files most people cannot read by eye. Send them to a mailbox set aside for them, or to a DMARC report service that turns them into a list of who sent mail as your domain and whether it passed. That list is how you find the sender nobody remembered, such as the card terminal that emails receipts.

Do not jump to a strict policy on day one. With p=reject set before every real service passes, your own invoices and booking confirmations can bounce. Move to p=quarantine once the reports show every real sender passing, watch for a few weeks, then move to p=reject.

A strict policy also protects your customers from fakes. Without it, anyone can send an email with your address in the From line, such as an invoice with someone else's bank details, and nothing tells the receiving server to stop it.

What Gmail, Yahoo and Outlook now require

Since February 2024, Gmail has set rules for everyone who sends to Gmail addresses, and Yahoo set similar ones at the same time. Every sender needs:

• SPF or DKIM for the sending domain.
• Valid forward and reverse DNS for the sending server, which your mail provider looks after.
• An encrypted connection when the mail is sent, which your provider also looks after.
• Few messages reported as spam. Google publishes a limit and shows the rate in its free Postmaster Tools, though the tool shows no data for a domain that sends little mail.

Senders of close to 5,000 messages a day to Gmail addresses count as bulk senders. They must also have both SPF and DKIM, a DMARC record (none is enough), a From address that matches the domain that passed, and a one-click unsubscribe on marketing email with a visible unsubscribe link. Yahoo asks bulk senders to act on an unsubscribe within two days. Microsoft started applying similar rules to high-volume senders to Outlook.com, Hotmail and Live addresses in May 2025, and failing mail goes to the junk folder first.

Gmail counts all the mail from your domain together, subdomains included, and once Google treats a domain as a bulk sender, it stays one even if you send less later. In November 2025 Google said it was stepping up enforcement, with temporary and permanent rejections for mail that does not comply.

Most small businesses send far fewer than 5,000 emails a day. Meet the bulk rules anyway. They cost a few DNS records, and one large newsletter in a busy season can put you over the line.

Fix the website form that sends as your customer

Many website forms send each enquiry to you with the customer's own address in the From line, so that pressing reply answers them. It looks convenient and it breaks the rules above. Your web server may not send mail as yahoo.com or gmail.com. Yahoo's own DMARC record tells receiving servers to reject such mail, and Google's sender guidelines tell senders not to put Gmail addresses in the From line of mail Gmail did not send. Enquiries from customers with those addresses are the first to vanish.

The fix is a setting in the form, not a new tool:

• From: an address on your own domain, such as website@ followed by your domain, sent through your mail provider or an email sending service that passes SPF and DKIM for your domain.
• Reply-To: the customer's address, so pressing reply still answers them.
• Subject: the kind of enquiry and the customer's name, so the office can sort them without opening each one.

Check how the website sends mail at all. Many sites on shared hosting use the server's built-in mail function, with no SPF or DKIM for your domain, from a machine shared with many other sites. Sending through your mail provider or a dedicated sending service fixes that too.

The confirmation the customer receives needs the same care. Send it from the same address, keep it short and leave out the text of their message. A form that emails whatever was typed to whatever address was typed lets spammers send their mail through your domain, and that harms every email you send. How to keep bots off the form is in how to stop contact form spam.

Then test it as a customer would. Send the form from a phone with a Gmail address, check that the notification and the confirmation both reach the inbox, and open Show original on each.

Then look at what you send, and to whom

Once the records pass, what is left is the mail itself and how people react to it. Providers learn from what recipients do, above all from people who press the spam button. The habits that cause trouble:

• Sending a newsletter to an old or bought list. Addresses that bounce and people who never asked to hear from you are where spam reports come from.
• No unsubscribe link in marketing email, so annoyed people press spam instead.
• A sudden large send from a domain that usually sends a handful a day.
• Links from a link shortener, a message that is one large image, or a subject line that promises more than the email holds.
• Sending from a no-reply address. Customers answer confirmations and quotes, and those replies should reach a person.

Keep marketing apart from everyday mail. Send newsletters through a newsletter tool set up for your domain, only to people who agreed to them, and keep quotes, invoices and booking emails in the tools and mailboxes customers expect them from.

When a customer finds you in spam, ask them to mark the message as not spam and add your address to their contacts. It helps their mailbox recognise you next time. It does not fix a failing record, so do it after the records pass, not instead.

When the problem is not your records

Sometimes everything passes and one customer still never sees your mail. Look at these next:

• A company recipient whose own mail filter holds messages for review. Their IT person can release your mail and allow your domain.
• A website on a shared server whose address is on a blocklist because of another site on the same machine. Blocklist operators such as Spamhaus have a free lookup. Moving form mail to your mail provider avoids the shared server altogether.
• Mail forwarded from an old address to a new one. Forwarding breaks SPF while DKIM usually survives, one more reason to set up DKIM everywhere.
• A new domain with no history. Send normal amounts to people who expect your mail, and hold the big first newsletter until the domain has sent everyday mail for a while.
• An expired domain or a cancelled mailbox plan. If the domain lapses, every email address on it stops with the website.

If you cannot reach your DNS settings at all because a past supplier holds the domain, that comes first: see how to get your website back from a web designer.

A checklist to keep

Run through this when you set up a new domain, launch a new website or add any tool that sends email for you:

• MX records point to the mail provider you use today, and nothing else.
• One SPF record, listing every service that sends as your domain and nothing you have stopped using.
• DKIM switched on in your mailbox provider and in every tool that sends as you.
• A DMARC record, with reports going to a mailbox or report service someone looks at.
• The website form sends from your own domain, with the customer's address as the reply-to address.
• Test emails of each kind reach a Gmail, an Outlook.com and a Yahoo address, with SPF, DKIM and DMARC all showing PASS.
• Marketing email has a one-click unsubscribe and goes only to people who agreed to it.

Then read the DMARC reports every few months for senders you do not recognise, and move the policy towards reject once only your own services appear.

These records belong with everything else that has to be right on launch day, such as redirects and the sitemap: see the website launch checklist. When we build a site, every form is tested from a phone before launch and the first real enquiries are checked to see that they arrive complete. See websites.