You send a quote. The customer swears it never arrived. Three days later it turns up in their spam folder under a mattress of pharmacy ads, and the job has gone to whoever answered faster. The same thing is happening to your invoices, your appointment reminders, and the reply you typed from the parking lot.
This is almost never about what you wrote. Mail providers stopped taking senders at their word, and a domain that cannot prove who it is gets treated like the fakes. The proof lives in three small DNS records — SPF, DKIM and DMARC — and most small-business domains are missing at least one.
Why this started happening
The rules changed in February 2024, when Google and Yahoo stopped asking nicely. Every sender to Gmail must now authenticate with at least SPF or DKIM. Anyone sending 5,000 or more messages a day must pass both, publish a DMARC policy, offer one-click unsubscribe on marketing mail, and keep the user-reported spam rate under 0.3%. Those requirements are still in force as of September 2026 — and Google’s guidance adds a detail worth knowing: cross the 5,000-a-day line once and the bulk-sender label is permanent.
Microsoft followed in May 2025 with matching rules for Outlook.com and Hotmail addresses, and the penalty stiffened along the way. Mail that fails these checks at volume is no longer filtered into spam — it is rejected outright, bounced back with an error code.
The practical effect: providers now grade the domain, not the message. A polite invoice from an unauthenticated domain scores worse than a mediocre newsletter from an authenticated one.
The three records, in owner’s English
All three are short text entries in your domain’s DNS — the same public directory that points your domain at your website. Adding them changes nothing on your computer or in your inbox.
SPF — the guest list
SPF names every service allowed to send email as your domain: your mail provider, your invoicing app, the website’s contact form. Receiving servers check the list, and anyone not on it looks like an impostor. Most SPF records were written once, years ago, and never updated as services were added — which is why the new booking system’s confirmations vanish.
DKIM — the tamper seal
DKIM adds a cryptographic signature to each message, checked against a key published in your DNS. Think of the foil seal on a medicine bottle: if the message was altered in transit, or never really came from your domain, the seal is broken and the receiver knows it.
DMARC — your standing instructions about fakes
DMARC tells the world’s mail servers what to do with a message that claims to be you but fails the other two checks — deliver it anyway, quarantine it, or reject it — and sends you reports either way. It is the record that makes life hard for anyone spoofing your name in a phishing run.
Check your domain in ten minutes, free
- Send a message from your business address to a personal Gmail account. Open it, choose Show original from the three-dot menu, and read the verdict line at the top: SPF, DKIM and DMARC, each marked pass or fail. That one screen is most of the diagnosis.
- Run your domain through a free DNS record checker. There are dozens, and because the records are public they all read the same data — pick any that shows your SPF, DKIM and DMARC and flags what is missing or malformed.
- If you send real volume to Gmail addresses, sign up for Google’s free Postmaster Tools. It shows your reputation and spam-complaint rate as Gmail actually measures them, not as you hope they are.
One check before touching DNS: if contacts are receiving mail you never sent, this is not a deliverability problem. Your account is compromised, and that is a faster-moving emergency.
Newsletters are judged harder than invoices
Providers treat everyday one-to-one mail — quotes, replies, invoices — differently from bulk marketing. The 5,000-a-day thresholds are aimed at bulk, but the distinction matters at any size, because every recipient who hits “report spam” on a newsletter counts against the same domain your invoices send from.
Two rules follow. Send marketing through a proper email platform that handles unsubscribes and list hygiene, not from your everyday mailbox with the customer list in BCC. And consider putting blasts on a subdomain — news.yourbusiness.com — so a bad campaign bruises that reputation instead of the one your invoices depend on.
The shared-hosting trap
If your email rides on the same cheap hosting plan as your website, it leaves from a server shared with hundreds of strangers. When one of them spams — one of them always does — the server lands on blocklists and your mail sinks with it. You did nothing wrong; you live in a bad neighborhood.
The durable fix is moving email to a dedicated service — Microsoft 365 set up properly, or Google Workspace — and migrating without losing years of old mail is its own job. Your website’s contact form should then send through an authenticated relay, not the web server.
The fix, in order
- List everything that sends as your domain. Mail provider, contact form, invoicing software, booking system, newsletter tool, CRM. Anything you miss here breaks in a later step, so be thorough.
- Publish one SPF record naming all of them. One record only — two SPF records is itself a failure. Each service’s help pages give the exact fragment to include.
- Turn on DKIM at every service. Each one issues its own key to add to your DNS. This is the step owners skip because it is fiddly and per-service; it is also the check that carries the most weight.
- Add DMARC in monitoring mode — a policy of “none” with a reporting address. Delivery does not change yet; you just start seeing who is sending as you, legitimate and otherwise.
- Read the reports for a few weeks, then tighten to quarantine and eventually reject, once everything legitimate passes. Tighten too early and you will bin your own invoices.
- Keep the complaint rate down. Stay under Gmail’s 0.3% spam-report threshold by pruning dead addresses and making unsubscribing easier than complaining.
What not to do
- Do not buy a mailing list. Purchased lists are salted with trap addresses that exist only to catch senders who mail strangers. One blast can undo a year of clean reputation.
- Skip the “warm-up” services. Tools that inflate your reputation by sending mail to a bot network that opens and replies are manipulation, providers treat them as such, and domains get burned for it. Real reputation comes from sending wanted mail to people who asked — slower, and it works.
- Do not resend harder. Firing the same message at the same address five times reads as spamming behavior, because it is.
- Do not flee to a fresh domain. A new domain has no reputation at all, which is worse than a bruised one, and the old problem follows the first time you repeat it.
If you’d rather not learn DNS for this
Deliverability has a defined finish line — every legitimate service passing SPF and DKIM, DMARC reporting quietly, your test mail landing in the inbox — and Koadi fixes it as a service. Post the problem free, set a fixed price or take bids from vetted, identity-verified technicians, and the money sits in escrow until you approve the result — which here means watching your own messages arrive where they belong. The work is done remotely anywhere in the US, evenings and weekends included, with on-site help through local techs if the trouble turns out to live in your office.