Why your business emails land in spam

You send a quote to a customer and hear nothing. A week later they call: “I found it in spam.” If that has happened more than once, the problem probably isn’t your wording. It’s that the recipient can’t confirm the email really is yours.

What changed

Since February 2024 Gmail requires every sender to prove they’re allowed to send from their domain. Anyone sending in large volumes needs all three settings I explain below. Yahoo did the same, and Microsoft followed in 2025. Emails that fail the checks go to spam or aren’t delivered at all.

Most small businesses never heard about it. Their info@ was set up five years ago, it worked, and nobody has opened the settings since.

The three settings, plainly

They go into your domain’s settings, once. They change nothing about how you write or send.

• SPF. The list of servers allowed to send email on your behalf. When a message arrives from info@yourbusiness.com, the recipient checks whether it came from someone on the list.
• DKIM. A digital signature on every message. It proves the email started with you and that nobody changed it along the way.
• DMARC. The instruction to the recipient: what to do with a message that claims to be from you but fails the checks. If you set it up, it also sends you reports, so you can see if someone is sending email pretending to be you.

The usual mistakes

• No settings at all. None of the three has ever been added.
• Two services, one on the list. Your email is with one provider, but your shop’s order confirmation emails or your contact form messages leave from a different server that isn’t in the SPF. Your personal emails arrive fine, your order confirmations don’t.
• Two SPF records instead of one. Someone added a second one instead of extending the first. With two records, the SPF check fails for all your email.
• A contact form that sends “from” the visitor. The site sends the message as if the customer wrote it from their own Gmail. The server receiving the message sees an unknown server sending on behalf of Gmail or Yahoo, and often rejects it.
• Business name, personal Gmail. “Maria’s Salon” from maria1987@gmail.com. It passes the checks, but it looks exactly like what scammers imitate, and the customer hesitates.

Check it in two minutes

1. Send an email from your business address to a Gmail account.

2. Open it, tap the three dots at the top right and choose “Show original”. You’ll see three lines: SPF, DKIM, DMARC. You want PASS on all three.

3. For a more detailed picture, mail-tester.com gives you an address, you send it an email, and it scores you out of 10 with an explanation for anything missing. Ours scores 10/10, and it isn’t hard to get there.

Don’t forget to check the emails your website sends too: order confirmations, form replies. That’s often where the problem hides.

The fix

If something is missing, the fix goes into your domain’s settings. It’s a few lines and, for whoever has access, half an hour’s work. The hard part usually isn’t the settings, it’s finding out who has access to your domain.

An honest note: the right settings don’t guarantee every email reaches the inbox. Content and the sender’s history matter too. But they remove the most common cause, and without them everything else matters little.

Want to look at it together? Send me an email from your business address. I can see what’s missing from the message itself, and I’ll tell you.