There are few things more frustrating than chasing a customer about an unpaid invoice, only to hear: "We never got it. Oh wait, it was in our junk folder." If your business emails are going to spam, it costs you money, time and a bit of credibility. The good news is that the cause is usually fixable, and it often comes down to three pieces of technical housekeeping with slightly off-putting names: SPF, DKIM and DMARC.
This guide explains what they are in plain English, why they matter more than ever, and what to do next.
Why email providers have become stricter
Email was designed decades ago with almost no way to prove who a message really came from. That is why scammers can send emails that appear to come from your bank, or even from your own business. To fight this, the big email providers, including Google, Microsoft and Yahoo, now check whether incoming messages can prove they are genuine. Google and Yahoo tightened their rules in 2024, and Microsoft has followed for its consumer mailboxes. If your domain cannot pass these checks, your emails are far more likely to be filtered as junk or rejected outright.
The checks rely on settings published in your domain's DNS, which is essentially the public address book for your website and email. Many small businesses set up their email years ago and never touched these settings, or had them configured only partially.
SPF: the approved sender list
SPF (Sender Policy Framework) is a list of the services that are allowed to send email using your domain name. Think of it as a guest list on the door. When a customer's mail server receives an email from you, it checks whether the server that sent it is on your list.
The catch is that most businesses send email from more places than they realise:
- Your main mailbox, such as Microsoft 365 or Google Workspace
- Accounting software that emails invoices, such as Xero, Sage or QuickBooks
- Newsletter tools like Mailchimp
- Your website contact forms
- Booking systems, CRMs or school and charity management platforms
If any of these are missing from your SPF record, their emails may fail the check. That is a very common reason invoices go to spam while ordinary emails arrive fine.
DKIM: a tamper-proof signature
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. The receiving server uses a key published in your DNS to confirm two things: that the email genuinely came from your domain, and that nobody altered it along the way.
A surprising number of businesses using Microsoft 365 have never switched DKIM on for their own domain, because email works without it. It simply works less reliably. Each service that sends on your behalf, such as your accounts package, usually needs its own DKIM setup too.
DMARC: the instructions and the reports
DMARC ties SPF and DKIM together. It tells receiving servers what to do if an email claiming to be from you fails the checks: let it through, put it in junk, or reject it. Crucially, it also sends you reports showing who is sending email using your domain name, which can reveal forgotten services or criminals impersonating you.
DMARC is usually introduced gradually. You start in monitoring mode, review the reports, fix any legitimate senders that are failing, then tighten the policy over time. Jumping straight to the strictest setting without that groundwork can block your own genuine emails, so it pays to take it in stages.
Common mistakes we see
- Having two separate SPF records, which breaks SPF entirely. There should only ever be one.
- An SPF record that has grown too long. SPF has a limit on how many lookups it can perform, and exceeding it causes failures.
- DKIM never enabled in Microsoft 365 or Google Workspace.
- No DMARC record at all, or one left in monitoring mode for years with nobody reading the reports.
- A new software system added that sends email, with nobody updating the DNS.
Other reasons emails land in junk
Authentication is the most common culprit, but not the only one. Your domain or server may be on a blocklist, often because an account was compromised and used to send spam. A hacked mailbox is worth ruling out quickly, as it is also a security issue. Content can matter too: emails with only an attachment and no message, lots of links, or wording that looks like a phishing attempt are more likely to be flagged. Sometimes the problem is on the recipient's side, with overly aggressive filtering.
How to check your own emails
A simple test: send an email to a personal Gmail address, open it, click the three dots and choose "Show original". You will see whether SPF, DKIM and DMARC say PASS or FAIL. Try it with an invoice sent from your accounts software as well as a normal email, as the results can differ.
If anything shows FAIL, or doesn't appear at all, that is a strong clue about where the problem lies.
Getting it fixed properly
The changes themselves are small, but getting them right matters. A mistake in your DNS can stop email or even your website working, and every business's mix of sending services is different, so there is no one-size-fits-all record to copy. It needs someone to identify everything that sends on your behalf, set up the records correctly, and keep an eye on the DMARC reports afterwards.
If your emails are going to spam, or you'd simply like to know whether your domain is set up properly, Cloud 4 Sure can help. We support businesses, schools, charities and care providers across Sussex, Surrey, Hampshire and Kent, and we're happy to take a look. Get in touch to book a free IT health check and we'll explain what we find in plain English.