“We never received your quote.” If a customer has ever said that, there is a good chance your email did arrive. It just went straight to their junk folder, where nobody looks.
For a business that sends quotes, invoices, booking confirmations and website enquiry notifications by email, that is not a minor irritation. It is lost revenue that never shows up as a complaint. This post explains why business emails land in spam, the three records that fix most of it, the setup mistakes behind most problems, and how to check your own domain in a few minutes.
Why Inboxes Distrust Your Email
Anyone Can Pretend to Be You
Email was designed without any built-in proof of who sent a message. Anyone can put your business address in the “From” line. Spammers and scammers do exactly that, which is why inboxes now check whether a message can prove it genuinely came from the domain it claims.
The Rules Have Tightened
Since February 2024, Google’s email sender guidelines require everyone sending to Gmail to set up SPF or DKIM, and require senders of more than 5,000 messages a day to set up SPF, DKIM and DMARC. Microsoft introduced similar requirements for high-volume senders to Outlook.com in 2025.
Even if you never send in bulk, an unauthenticated business email is now easy for a filter to distrust.
The Three Records, in Plain English
SPF: Who Is Allowed to Send for You
SPF is a DNS record listing the servers and services allowed to send email using your domain. If your email comes from Google Workspace, your newsletter platform and your accounting system, all three need to be in it. Google’s guide to setting up SPF shows the format.
DKIM: A Signature on Every Message
DKIM adds a cryptographic signature to each email. The receiving server checks it against a public key in your DNS, which proves the message really came from your domain and was not altered on the way. Most email providers let you switch it on, as in Google’s DKIM setup guide.
DMARC: The Instructions and the Reports
DMARC tells receiving servers what to do when a message fails SPF and DKIM checks: deliver it anyway, send it to spam, or reject it. It also sends you reports showing every service sending email as your domain, including ones you did not know about. Google’s guide to setting up DMARC recommends starting with a monitoring-only policy before tightening it.
The Most Common Setup Mistakes
Two SPF Records Instead of One
Each service you add tells you to “add this SPF record”, so many domains end up with two or three. The SPF standard says a domain must not publish multiple SPF records, and if it does, the check returns an error. In other words, two SPF records are worse than one: they break SPF entirely. The fix is a single record that includes every legitimate sender.
Too Many Lookups
The same standard limits SPF to 10 DNS lookups. A record that includes a long list of services can exceed that limit, and SPF fails again. This usually happens gradually, as tools get added over the years and nobody removes the old ones.
A Sender Nobody Remembered
Your mailbox might be set up perfectly while your CRM, invoicing software, booking system or newsletter tool sends as your domain without being authorised. Those emails fail checks even though everything else works.
The Website Contact Form
This one catches many business owners out. A website form often sends its notification email using the visitor’s address in the “From” line, so it looks like the customer emailed you directly. To a receiving server, that is your website pretending to be someone else’s domain, and it fails authentication.
The result is enquiries quietly going to junk. The fix is to send form notifications from your own domain through an authenticated mail service, and put the visitor’s address in the reply-to field. If your forms are already losing people before they even submit, our guide on why your contact form is costing you enquiries covers that side.
DMARC Left at Monitoring Forever, or Tightened Too Early
A DMARC policy set to reject on day one can block your own legitimate emails if a sender was missed. A policy left at monitoring forever never stops anyone impersonating you. The right path is monitoring first, reading the reports, fixing every legitimate sender, then tightening.
Signs Your Emails Are Being Filtered
Customers Keep Asking You to Resend
The clearest sign is a pattern of “I didn’t get it” from customers, suppliers or new enquiries, especially if they use Gmail or Outlook accounts. One missing email is chance. Several in a month is a signal.
Replies Dropped Without an Obvious Reason
If quotes or follow-ups that used to get replies have gone quiet, and nothing about your offer changed, deliverability is worth ruling out before you rewrite anything.
Your Own Test Lands in Junk
Send a normal business email to a personal Gmail or Outlook address you control. If it lands in junk, your customers’ copies are very likely landing there too.
How to Check Your Own Email in Five Minutes
Use Gmail’s “Show Original”
Send an email from your business address to a Gmail account. Open it, use the message menu and choose “Show original”. Gmail’s guide to viewing full message headers explains the screen. Near the top you will see SPF, DKIM and DMARC, each marked pass or fail.
If all three say pass, your main mailbox is in good shape. Then repeat the test with an email from your website form, your invoicing tool and your newsletter platform. Problems usually hide there.
For Larger Senders, Watch Reputation
If you send marketing emails in volume, Google’s Postmaster Tools shows how Gmail sees your domain, including spam complaint rates and authentication results.
Fixing It, Step by Step
1. List Every Service That Sends as You
Mailbox provider, website, CRM, invoicing, booking, newsletters, support desk. This list is the foundation of everything else.
2. Publish One Correct SPF Record
Combine every legitimate sender into a single SPF record, and remove services you no longer use.
3. Turn On DKIM Everywhere It Is Offered
Enable DKIM in your mailbox provider and in each sending tool that supports it.
4. Start DMARC in Monitoring Mode
Publish a DMARC record with a monitoring policy and a reporting address. Review the reports for a few weeks and fix anything legitimate that is failing.
5. Tighten the Policy
Once every legitimate sender passes, move DMARC to quarantine, then reject. At that point, people impersonating your domain lose most of their ability to reach inboxes.
6. Fix the Website Form
Make sure form notifications send from your domain through authenticated mail, not from the visitor’s address.
Who Should Make These Changes
All of this happens in your domain’s DNS settings, which is exactly why knowing who controls your domain matters. If you are not sure who has access, start with our guide on who actually owns your website, domain and hosting.
Authentication Is the Start, Not the End
Correct records prove your email is genuine. They do not make a bad sender look good. A website that has been compromised and is sending spam from your server will damage your domain’s reputation regardless of your records, which is one more reason to follow the basics in our website security checklist.
The Bottom Line
Most business emails that land in spam are not being judged on what they say. They are failing to prove where they came from. SPF lists who may send for you, DKIM signs every message, and DMARC tells inboxes what to do with failures and shows you who is sending as you.
The usual culprits are simple: duplicate SPF records, a forgotten sending tool, and a website form pretending to be the visitor. Five minutes with Gmail’s “Show original” tells you where you stand.
If you want your domain checked and fixed properly, including your website forms, our website design team can review your setup and make the changes for you.
WhatsApp Hameed for a quick question, or call +971 56 544 6241 for a free consultation.
An email that lands in junk does not bounce and does not complain. It just quietly costs you the reply.
