TrimpeTech Blog  •  Email Deliverability

Why Your Business Emails Are Going to Spam

You wrote a perfectly normal email and it vanished into a junk folder. Here is what inbox providers are actually checking, and how to find out whether your domain passes.

By Robert Trimpe  •  October 2026  •  8 min read

Back to Blog

A customer says they never got your quote. A client finds your invoice in their junk folder. Worse, someone gets an email that looks like it came from you, but you never sent it.

All three problems usually trace back to the same place: a few short lines of text in your domain's DNS settings that most business owners have never seen. This post explains what those lines do, why they quietly break, and how to check yours in about ten minutes, with no technical background required.

How inbox providers decide

Email was designed in an era when anyone could claim to be anyone. Your "From" address is not proof of anything; it is just a label, like writing a return address on an envelope. So Gmail, Outlook, and Yahoo run a quick background check on every message before deciding where it goes.

The question they are really asking is: "Is this server allowed to send mail for this domain?" If the answer is clearly yes, your message goes to the inbox. If it is unclear, it may go to spam. If the answer is no, it can be rejected outright.

The three records, in plain English

These three records live in your domain's DNS, the same settings area that points your website to the right place. Each one answers a different question.

Record 1

SPF

The guest list

A published list of which services are allowed to send email as your domain: your email provider, your newsletter tool, your invoicing software. If a sender is not on the list, receivers get suspicious.

Record 2

DKIM

The wax seal

A digital signature added to each outgoing message. Receivers use a public key in your DNS to confirm the message really came from you and was not altered along the way.

Record 3

DMARC

The rulebook

Tells receivers what to do when SPF or DKIM fails (nothing, spam folder, or reject) and asks them to send you reports so you can see who is sending as your domain.

Put together, the three checks decide where a message lands. And it only takes one failure to change the outcome.

PATH A: All three checks passYour emailsent to a customerSPF ✓Right server?DKIM ✓Unaltered?DMARC ✓Your domain?InboxDelivered normallyPATH B: One check failsYour emailsent to a customerSPF ✓Tool's domainDKIM ✓Tool's domainDMARC ✗Not your domainSpam folderor rejected outright PATH A: All three checks passYour emailSPF ✓Right server?DKIM ✓Unaltered?DMARC ✓Your domain?Inbox Delivered normallyPATH B: One check failsYour emailSPF ✓Tool's domainDKIM ✓Tool's domainDMARC ✗Not your domainSpam folder or rejected outright
One failure is enough. In Path B, SPF and DKIM pass, but only for the sending tool's domain, not yours, so DMARC fails. Reason #1 below explains how that happens.
Why this matters now The rules have tightened. Since February 2024, Google and Yahoo have required full SPF, DKIM, and DMARC from bulk senders (roughly 5,000+ messages a day), and Microsoft began enforcing similar requirements for Outlook.com in May 2025. A small business does not hit those volume numbers, but the same checks influence where everyone's mail lands. Google also expects every sender to have at least SPF or DKIM in place. Treat all three as the baseline.

Five reasons good email goes bad

In practice, the problem is rarely that someone never set these up. It is that they were set up once, years ago, and then your business changed.

1

You added a new tool that sends as you

A newsletter service, a CRM, appointment reminders, invoicing software. Each one sends email using your domain, and each one needs to be added to your SPF record and set up with its own DKIM key. This is the single most common cause. One catch: some tools sign mail with their domain instead of yours. SPF and DKIM can both pass for the tool while DMARC still fails for you, because neither check matched your domain. Look for a "custom domain" or "domain authentication" setting in the tool.

2

You have two SPF records instead of one

A domain can have only one SPF record. When a new tool's setup guide says "add this record," it is easy to add a second one instead of merging it into the first. Two SPF records means SPF fails for everything.

3

Your SPF record has grown too long

SPF is limited to 10 DNS lookups. Every "include" for a service counts, and some count several times. Past the limit, receivers treat the record as broken even though it looks fine to the eye.

4

DKIM was never switched on

Many email platforms create the DKIM key but leave it off until you publish a record and click a verify button. Skipping that step is easy, and nothing visibly breaks until deliverability slowly slides.

5

Your website's contact form sends "as you"

Many websites send form notifications through the web host's generic mail server while using your address in the From line. To receivers, that looks exactly like spoofing, and it is one of the easiest things to fix once you know to look.

YOUR SPF RECORDWHO TRIES TO SEND AS YOURESULTThe guest listyourdomain.com✓ Email providerYour email providerOn the list✓Inbox✓ Newsletter toolNewsletter toolOn the list✓Inbox✓ Invoicing appInvoicing appOn the list✓InboxWebsite contact formNever added (reason #5)✗Spam folderImpersonatorPretending to be you✗Spam or blockedAnyone not listedlooks like an impersonator Your SPF guest listyourdomain.com✓ Email provider✓ Newsletter✓ InvoicingYour email providerOn the list✓InboxNewsletter toolOn the list✓InboxInvoicing appOn the list✓InboxWebsite contact formNever added✗SpamImpersonatorPretending to be you✗Spam/blocked
Your SPF record is a guest list. Senders on it get through. Anything missing, including tools you forgot to add, looks the same as an impersonator.

Authentication is not the only factor. Spam complaints, purchased lists, and spammy wording all hurt too. But if authentication is broken, nothing else you do will fully compensate.

Try it yourself: the 10-minute check

Check your own domain

  1. Send a test email from your business address to a personal Gmail account.
  2. Open the message in Gmail, click the three-dot menu, and choose Show original.
  3. Look at the top summary. You want to see PASS next to SPF, DKIM, and DMARC. Any FAIL or missing line is your answer.
  4. Repeat for every tool that sends as your business: newsletter, invoices, contact form. Each one can pass or fail independently.
  5. Look up your DNS records with a free lookup tool (Google's Admin Toolbox or MXToolbox both work). Search your domain for TXT records and count how many start with v=spf1. The answer should be exactly one.
Original message
Healthy
SPF:
PASS with IP 203.0.113.10
DKIM:
PASS with domain yourdomain.com
DMARC:
PASS
Original message
Needs attention
SPF:
FAIL with IP 198.51.100.7
DKIM:
No line at all (not set up)
DMARC:
FAIL

Simplified example of the summary at the top of the "Show original" view. A missing line counts as a problem, just like a FAIL.

For reference, a healthy record for a business using Google Workspace looks something like this. Yours will differ depending on which services you use.

Example SPF record (TXT, at your domain root) v=spf1 include:_spf.google.com ~all

Turning on DMARC without breaking anything

The mistake people make with DMARC is jumping straight to the strictest setting and accidentally blocking their own invoices. The safe path is a staircase: watch first, then tighten once you have confirmed that everything legitimate passes.

STEP 1Watchp=noneMonitor only.Read the reports.STEP 2Filterp=quarantineFailures go to spam.Fix any stragglers.STEP 3GOALBlockp=rejectSpoofed mail is refused.Your domain is protected.after 2–4 clean weeksafter 2–4 clean weeks STEP 1Watchp=noneMonitor only.Read the reports.after 2–4 clean weeksSTEP 2Filterp=quarantineFailures go to spam.Fix any stragglers.after 2–4 clean weeksSTEP 3Blockp=rejectSpoofed mail is refused.Your domain is protected.GOAL
Climb one step at a time. Move up only after a few weeks of reports show all your legitimate mail passing.
Example starter DMARC record (TXT, at _dmarc.yourdomain.com) v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

That rua address is where receivers send daily summary reports. They are dense XML files, so most small businesses route them to a free report-reading service rather than reading them by hand.

What you seeWhat it usually meansUrgency
SPF, DKIM, and DMARC all PASSYour setup is healthy for that sending tool.Good
SPF PASS, DKIM missingWorks for now, but forwarded mail and strict receivers may still reject it.Medium
No DMARC record at allAnyone can send as your domain and you will never know.Medium
SPF and DKIM PASS, DMARC FAILBoth passed for the tool's domain, not yours. Turn on the tool's custom domain setting.High
Two or more SPF recordsSPF is invalid for every message you send.High
FAIL on a specific tool onlyThat service is not in your SPF or its DKIM was never verified.High
From our own files

We hit this on our own sites. While reviewing ChristineTrimpe.com, we added and adjusted SPF, DKIM, and DMARC records so that only approved services could send mail as that domain and spoofed messages stopped looking legitimate. The fix took minutes. Finding which senders were missing was the real work.

The short version

If your email is landing in spam, check authentication before you rewrite a single subject line. Make sure there is one SPF record that lists every service that sends for you, that DKIM is verified for each of them, and that a DMARC record exists, even if it starts at monitor-only. Then climb the staircase.

If you would rather have someone read the records for you, that is exactly what our Website Health Audit does.

Not sure if your email passes the check?

Our Website Health Audit reviews your DNS and email authentication and gives you a plain-English report with the exact fixes.

Request a Website Health Audit See What's Included
Browse all TrimpeTech services