Why your business emails go to spam, and the 3 DNS records that fix it

Your invoice lands in the customer's spam folder. A booking confirmation never arrives. Password-reset emails vanish. For a new business, the cause is usually not what's in the email. It's that nobody set up the records that prove the email came from you.

What changed

Since 2024, Gmail and Yahoo require bulk senders to authenticate their email with SPF, DKIM and DMARC (Google's sender guidelines). Microsoft followed for Outlook.com in May 2025 and now rejects failing bulk mail with the error 550 5.7.515. The strict rules are written for large senders, but the same checks decide where everyone's mail lands. A small business with no records is easy to mistake for someone faking its name.

The three records, in plain English

All three are text entries in your domain's DNS settings, at your registrar, Cloudflare or your host.

SPF: who may send as you. A list of the services allowed to send email for your domain, for example your Google Workspace, your CRM and your invoicing tool. There can only be one SPF record per domain, and it may trigger at most 10 DNS lookups. Adding a new tool by pasting a second SPF record, or chaining too many includes, silently breaks it.

DKIM: a signature on each email. Each sending service signs your emails with a key, and you publish the matching public key in DNS. You set it up once per service, usually by adding a record the service gives you.

DMARC: what to do when checks fail, and reports. It tells Gmail and Outlook what to do with email that claims to be from you but fails SPF and DKIM: nothing (p=none), spam folder (p=quarantine) or reject (p=reject). It also sends you reports of who is sending as your domain, which is how you find the tools you forgot.

Check your domain in five minutes

1. Send an email from your business address to a Gmail account.
2. Open it in Gmail, click the three dots, and choose Show original.
3. Look for SPF, DKIM and DMARC. Each should say PASS.
4. Repeat for every tool that sends as you: your website's contact form, invoicing, CRM, newsletter, booking system.

Anything that says FAIL, or doesn't appear, needs fixing.

Fix it safely

1. List every sender. Your mailbox provider plus every tool that sends as your domain. This is the step people skip.
2. One SPF record that includes each sender and stays under 10 lookups.
3. DKIM for each sender, using the records each service provides.
4. DMARC at p=none with a reporting address. Nothing gets rejected yet.
5. Read the reports for two to four weeks. Find any sender that fails and fix it.
6. Tighten to p=quarantine, then p=reject. Now fake email in your name gets blocked too.
7. Protect unused domains. A domain you own but never send from should say so, so it can't be used to fake your name.

Every time you add a new tool that sends email, repeat steps 1–3 for it.

What this won't fix

Authentication is the entry ticket, not a guarantee. If people mark your emails as spam, or a list was bought, no DNS record will help. And this is about sending, not about mailboxes that can't receive.

Want it done for you?

My Email Authentication Setup finds every service that sends as your domain, sets up SPF, DKIM and DMARC, and tests delivery to Gmail and Outlook. From $130 for one domain; the Standard plan watches the reports for four weeks and moves DMARC to full enforcement.