Why Your Business Email Goes to Spam, and How to Fix It for Good
A client tells you they never received your proposal. You check your sent folder and it is right there. You resend it, they find it in junk, and everyone moves on. Three weeks later it happens again with a different client, and this time it was an invoice.
Most small businesses treat this as an annoyance rather than a problem with a cause. It has a cause, it is almost always the same one, and it is fixable in a day or two. Your domain is failing email authentication, and receiving mail servers are treating your messages as suspicious because of it.
Email Changed and Nobody Told Small Businesses
For most of email's history, a receiving server had no reliable way to know whether a message claiming to be from your company actually came from your company. Anyone could put anything in the "From" field. That is how phishing worked for two decades.
The response was a set of three DNS-based standards that let a domain owner declare who is allowed to send on their behalf, and let receiving servers verify those claims. For years these were treated as optional best practice. They are no longer optional.
In February 2024, Google and Yahoo began enforcing authentication requirements for bulk senders, including a DMARC record. Microsoft followed with similar requirements for high-volume senders. The thresholds officially target large senders, but the practical effect reached everyone: filtering systems now weight authentication heavily as a trust signal, and a domain with broken or missing records looks worse than it did three years ago.
If your email setup was configured in 2019 and never revisited, it is very likely failing checks that did not exist or did not matter when it was built.
The Three Records That Decide Whether You Reach the Inbox
All three live in your domain's DNS. None of them cost anything. All three need to be correct, and getting two right out of three is not a passing grade.
SPF: Who Is Allowed to Send as You
SPF, or Sender Policy Framework, is a DNS record listing the mail servers permitted to send messages using your domain. When a receiving server gets mail claiming to be from your company, it checks whether the sending server appears on your list.
SPF problems we see repeatedly in small business setups:
- Two SPF records on one domain. This is not additive. Having two records is a specification violation, and many receiving servers treat the result as a permanent failure. This usually happens when a business adds a marketing platform and someone creates a second record instead of editing the existing one.
- Exceeding the ten-lookup limit. SPF permits a maximum of ten DNS lookups when evaluating a record. Every service you add with an "include" statement consumes at least one. A business using email hosting, a CRM, an invoicing tool, a marketing platform, and a helpdesk can quietly cross the limit, at which point evaluation fails entirely.
- Missing services that actually send mail. Your accounting software sends invoices. Your scheduling tool sends reminders. Your website sends contact form notifications. If those are not authorized in your SPF record, they fail authentication even though they are legitimate.
- Ending in a soft fail forever. A record ending in ~all tells receivers to accept but flag unauthorized mail. That is the correct setting while you are testing. Left in place indefinitely, it tells receiving servers you are not confident about your own configuration.
DKIM: Proof the Message Was Not Altered
DKIM, or DomainKeys Identified Mail, attaches a cryptographic signature to every outgoing message. The receiving server retrieves your public key from DNS and verifies the signature. If it matches, the message genuinely originated from an authorized system and was not modified in transit.
DKIM is usually enabled in your mail platform's admin console and requires publishing a corresponding DNS record. The most common failure is enabling it on one platform while a second system that also sends as your domain remains unsigned. Every service that sends mail as you needs its own DKIM configuration.
DMARC: The Policy That Ties It Together
DMARC tells receiving servers what to do when a message fails SPF and DKIM, and it is the only one of the three that reports back to you.
A DMARC record has a policy setting with three possible values:
- p=none means take no action but send reports. This is the correct starting point. It gives you visibility into who is sending mail as your domain without risking legitimate messages.
- p=quarantine means route failing messages to spam.
- p=reject means refuse failing messages outright.
The reporting is the underrated part. Within a week of publishing a DMARC record with reporting enabled, you receive data showing every system sending mail using your domain. Businesses are routinely surprised. That old invoicing tool nobody cancelled is still sending. A former employee's automation is still running. And occasionally, someone unrelated to your company is sending mail as you.
Domain Spoofing Is the Risk Nobody Budgets For
Authentication is usually framed as a deliverability issue, which undersells it. Without an enforcing DMARC policy, anyone can send email that appears to come from your domain.
The version of this that costs real money works like this. An attacker learns that your firm is working with a client on a transaction. Shortly before closing, the client receives an email that appears to come from your company, with your formatting and signature, providing updated wire instructions. The money goes to the attacker. The client's first call is to you.
This attack is cheap, requires no access to your systems, and is largely prevented by a correctly enforced DMARC policy. For law firms, title companies, accounting practices, and real estate offices in St. Charles County and across the St. Louis area, this is the strongest argument for getting authentication right, well ahead of inbox placement.
Diagnosing Your Own Domain
You can get a useful picture without any special tools.
- Send a message to a Gmail account you control. Open it, choose "Show original," and look at the SPF, DKIM, and DMARC lines. Each should say PASS. Anything else is your answer.
- Check for a single SPF record. Look up your domain's TXT records and confirm exactly one begins with v=spf1.
- Check whether DMARC exists at all. Look up the TXT record at _dmarc.yourdomain.com. Many small businesses have nothing there.
- Inventory everything that sends as you. Mail platform, website forms, CRM, invoicing, scheduling, marketing, helpdesk, e-signature. Each one needs authorization.
Fixing It Without Breaking Anything
The order matters. Publishing an enforcing DMARC policy before your legitimate senders authenticate correctly will send your own invoices to spam. A safe sequence looks like this:
- Inventory first. Build the complete list of systems sending mail as your domain before changing any records.
- Consolidate SPF into one clean record. Remove duplicates, drop services you no longer use, and stay under the ten-lookup limit.
- Enable DKIM on every sending platform. Not just the main one.
- Publish DMARC at p=none with reporting. Collect data for two to four weeks and confirm that everything legitimate is passing.
- Move to quarantine, then reject. Only once the reports are clean. Rushing this step is how businesses break their own billing.
Done properly this is a few hours of work spread across a month of monitoring, and it does not need repeating unless you add new sending services. It is one of the few technology fixes that is genuinely permanent.
When Email Came Bundled With Your Web Hosting
One structural problem no amount of DNS tuning fixes: email included as a free add-on with inexpensive web hosting typically sends from IP addresses shared with hundreds of other websites. Your reputation is partly determined by strangers. If one of them starts sending spam, your invoices suffer.
Bundled email also tends to lack proper archiving, reliable mobile synchronization, administrative controls, and offboarding tools. If email is how your business gets paid, it belongs on a real mail platform rather than as a checkbox on a hosting plan.
Getting It Sorted
Email deliverability is unglamorous and it directly affects revenue. A proposal in a junk folder is indistinguishable from a proposal you never sent.
Archway Point handles business email setup, migration, and deliverability repair for small businesses and professional firms in St. Charles County and the greater St. Louis area, including SPF cleanup, DKIM signing, staged DMARC rollout, and ongoing monitoring. If your mail is landing in spam, or you have never checked whether your domain can be spoofed, get in touch and we will start with an audit of what your domain is actually publishing today.