Key takeaways
- Business emails usually land in spam because the receiver can’t confirm they really came from you, or the message looks risky.
- Test first. Send an email to a Gmail address, choose “Show original”, and look for SPF, DKIM and DMARC all saying PASS.
- Common causes: DKIM not switched on, two SPF records, and apps like website forms, quoting or invoicing tools sending as your domain without permission.
- Fix the records first, then the habits. Start DMARC on “none” so you don’t block your own mail.
- Since February 2024, Google requires SPF or DKIM from everyone who emails Gmail addresses.
Why business emails go to spam
Mail systems decide where an email goes by asking two things: can we confirm this came from the domain it claims, and does it look like spam. For a small business it’s usually the first one. Getting three records right in your domain settings, called SPF, DKIM and DMARC, often fixes it.
Say a plumber in Ipswich sends a quote to a property manager, and never hears back. The property manager may not be ignoring him. The quote could be sitting in spam. It’s worth finding out.
Check yours in two minutes
- Send an email from your business address to a Gmail address you can open.
- Open it, click the three dots at the top right, and choose Show original.
- Look at the top for SPF, DKIM and DMARC. Each should say PASS.
If any says FAIL, NEUTRAL or doesn’t appear, that’s where to look. Repeat the test for every way you send: your mail app, your website contact form, and any quoting or invoicing app. Each one can fail on its own.
What the three records do
- SPF is a list of the servers allowed to send email as your domain.
- DKIM adds a digital signature to each email, so the receiver can tell it wasn’t changed on the way.
- DMARC tells the receiver what to do when an email fails those checks, and sends you reports.
Our business email guide shows where they sit in the set-up. These records live in your domain’s DNS settings, so you need the login for wherever your domain is managed. If you’re not sure who that is, see domain name vs web hosting.
The usual causes
DKIM isn’t switched on
Setting up the email account doesn’t always switch DKIM on for your own domain. In Microsoft 365 you add two CNAME records, named selector1._domainkey and selector2._domainkey, then switch DKIM on in the Defender portal. In Google Workspace you generate the key in the Admin console, add it to your domain settings, then click Start authentication.
SPF is wrong
A domain should have only one SPF record. A common slip is adding a second one when you start using a new app, and then the checks can fail. Put everything in one line instead. For Google Workspace it looks like this:
v=spf1 include:_spf.google.com ~all
And for Microsoft 365:
v=spf1 include:spf.protection.outlook.com -all
If you also use a newsletter or quoting tool, its “include” goes in that same line. SPF also has a limit of 10 DNS lookups, so a long list of apps can break it.
Another app is sending as you
Website contact forms, quoting, invoicing, booking and newsletter tools often send email that says it’s from your address. If the tool isn’t authorised in your SPF, or doesn’t sign with its own DKIM for your domain, receivers get suspicious. Each tool’s help page shows what to add.
Contact forms are a classic. A WordPress site that sends mail straight from the web server, with no sign-in, often ends up in spam. The fix is to send form emails through your real mail provider instead. If spam is going out from your website and you didn’t send it, the site may have been hacked. Here’s what to do first.
DMARC is too strict, too soon
Setting DMARC to “reject” before every sender is sorted can block your own mail. Start with “p=none”, which only watches, read the reports, and tighten it later.
The sender looks off
A brand new domain has no history, so its first emails are treated with caution. A display name that pretends to be someone else, or a reply-to address on a different domain, can also look dodgy.
Habits that get you flagged
- Sending a newsletter to hundreds of people from a normal mailbox. Use a proper mailing tool.
- Emailing lists of people who never asked to hear from you.
- Emails that are mostly one big image, or full of link shorteners.
- No way to unsubscribe from marketing emails.
In Australia, the Spam Act 2003 says marketing emails need the person’s consent, must say who sent them, and must include a working unsubscribe. Google’s rules for bulk senders, anyone sending more than 5,000 emails a day to Gmail addresses, go further and ask for all three records and one-click unsubscribe.
If it still goes to spam
Ask the person to mark your email as “Not spam” and add you to their contacts. That helps with their mailbox. For a quote that really matters, follow up by phone as well.
If the test passes and mail still lands in spam, the content or your sending habits are the next place to look. If you’d rather not touch DNS yourself, we do this as part of business email set-up.
Questions people ask
Why do my emails go to spam when I’ve done nothing wrong?
Usually because the receiving system can’t confirm the email came from you. Missing or broken SPF, DKIM or DMARC records are the most common reason, and an app sending as your domain without permission is the next.
Do I need DMARC if I’m a small business?
Google only requires it from bulk senders, but it’s free to add, and starting on “none” does no harm. It also sends you reports showing who’s sending email as your domain.
How long do DNS changes take?
Often minutes to a few hours. Google says new records can take up to 72 hours to be recognised, so test again the next day.
Why do my website form emails go to spam?
Forms often send mail from the web server with no sign-in, so receivers can’t verify it. The fix is to send the form’s email through your real mail provider, and check SPF and DKIM pass.
We’re in Brisbane and look after business email for small businesses around South East Queensland. If your mail keeps landing in spam, give us a call on 0432 631 964 and we’ll have a look.