Why your business emails go to spam, and how to fix it
Updated: 2 days ago
The most common reasons business emails go to spam are SPF, DKIM or DMARC records that are missing or set up wrongly, a new tool sending email in your name that was never added to those records, a change of email provider that left old records behind, a mailbox that was hacked and used to send spam, and sending habits such as large sends from an ordinary mailbox. Most of these come down to one thing: your domain can't prove the email came from you. Three records on your domain, called SPF, DKIM and DMARC, do that job, and when one is missing, out of date or set up wrongly, receiving mail servers treat your email with suspicion. Gmail says that messages which aren't authenticated might be marked as spam or rejected outright. The fix is usually a short piece of work on your domain's settings rather than anything to do with what you write, although how you send matters too.
What do SPF, DKIM and DMARC do?
SPF is a list, published on your domain, of the services allowed to send email as you, such as Microsoft 365, your accounting software and your newsletter tool. DKIM adds a signature to each email that the receiving server checks against a key on your domain, which shows the message really came from an approved sender and wasn't changed on the way. DMARC ties the two together: it tells receiving servers what to do with email that claims to be from you but fails the checks, and sends you reports on who is sending in your name.
Google's email sender guidelines require everyone sending to Gmail addresses to use SPF or DKIM, and anyone sending more than 5,000 messages a day to use all three. Most small businesses never reach that volume, but the same records decide whether their everyday email is trusted.
Why does email land in spam when it used to work?
The most common reason is a new tool. When you start sending invoices from accounting software, quotes from a CRM or newsletters from a mailing service, those emails go out from someone else's servers in your name. If nobody adds the new service to your SPF record or sets up DKIM for it, those emails fail the checks, even though email from your main mailbox is still fine.
Other causes include a change of email provider that left the old records behind, an SPF record that has grown too long to be read properly, and a mailbox that was used to send spam after its password was stolen. These records sit alongside the other settings covered in our guide to DNS protection and domain security, and they tend to go wrong for the same reason: nobody owns them.
What does "DMARC policy not enabled" mean?
This warning, which comes up in email checking tools and some providers' reports, usually means your domain has a DMARC record set to monitor only, known as p=none, or no DMARC record at all. Monitoring is the right place to start, because it shows you which services send in your name before you tell anyone to turn failing email away.
It isn't the right place to stay. The NCSC's email security and anti-spoofing guidance recommends moving to a policy of reject once you're confident SPF and DKIM are working, applying it to a small share of email first and increasing it gradually while you watch the reports. While DMARC stays on monitor only, anyone can still send email that pretends to come from you.
How do you fix it?
Start by listing every service that sends email as your domain: your main mailbox provider, plus anything that sends invoices, quotes, notifications or newsletters. Then check that your SPF record includes each of them and nothing you no longer use, set up DKIM for each service that supports it, and add a DMARC record at p=none with reports going to an address someone reads. After a few weeks of reports, you'll see whether anything genuine is failing. Fix those, then tighten the policy step by step as the NCSC describes.
If email still lands in spam once the records pass, look at how you send. Large sends from an ordinary mailbox, bought-in lists, marketing email without an unsubscribe link or links to a site with a poor reputation can all count against you. Google asks bulk senders to keep the spam complaint rate shown in its Postmaster Tools below 0.3%, which gives a sense of how few complaints it takes.
Is this your problem?
These questions usually show where the trouble is.
Do you know every service that sends email using your domain?
Has anyone checked your SPF, DKIM and DMARC records since you last added a new tool?
Do your DMARC reports go to an inbox someone reads?
Have customers or suppliers told you they found your emails in spam?
If you can't answer the first two, that's usually where the problem is.
The short version
Business email goes to spam mostly because the domain can't prove the email is genuine. Get SPF, DKIM and DMARC right for every service that sends as you, update them when you add new tools, and move DMARC from monitoring to enforcement once the reports are clean. That fixes most delivery problems and stops other people sending email in your name.
Our Email Health Check reads your domain's SPF, DKIM and DMARC records and shows what's missing or set up wrongly. If it finds problems, we fix them in your domain's public DNS records for £250 per domain, and can monitor them for £35 a month per domain, with no contract.
