SPF, DKIM and DMARC: why your business email lands in spam (and how to fix it)

You send a proposal. The client never replies. Days later you find out the email went to their spam folder — or was rejected entirely. For small businesses this is one of the most expensive silent problems there is, because you rarely find out it happened.

The cause is usually not your email content. It’s your domain’s email authentication: three DNS records called SPF, DKIM, and DMARC. Since 2024, Google and Yahoo require them for senders who mail their users in any volume — and even low-volume business mail gets filtered harder when they’re missing. Here’s what each one does, without the jargon.

Think of it as ID for your email

• SPF is a guest list. It’s a DNS record that says “these servers are allowed to send email for my domain.” If a message arrives from a server not on the list, the receiving server gets suspicious.
• DKIM is a signature. Your mail server stamps each outgoing message with a cryptographic signature tied to your domain. The receiver checks the signature against a key published in your DNS. If it matches, the message provably wasn’t tampered with — and provably came from an authorized system.
• DMARC is the instruction manual. It tells receivers what to do when SPF or DKIM checks fail (monitor, quarantine to spam, or reject outright) and where to send reports about it. It also enforces alignment: the domain in the visible “From” address must match the domains that SPF and DKIM verified.

You need all three working together. SPF alone, without DMARC alignment, is a guest list nobody is required to check.

The mistakes that put you in spam

In audits of small-business domains, the same failures show up repeatedly:

1. Multiple SPF records. A domain may have exactly one. Add your website host, then Google Workspace, then a marketing tool — each “helpfully” adding its own record — and the result is a permanent error that invalidates all of them.
2. The 10-lookup limit. SPF can trigger at most 10 DNS lookups. Stack enough include: entries from different services and you silently exceed it, which also invalidates SPF.
3. DKIM enabled nowhere, or everywhere except where you send. Your CRM, your invoicing tool, and your newsletter platform each sign with their own selector — each one has to be set up individually. The one you forget is the one whose mail lands in spam.
4. DMARC stuck at p=none forever — or missing entirely. p=none is a fine starting policy while you monitor reports, but it gives receivers no instruction to act on failures.
5. Your website’s forms send as your domain from an unauthorized server. The classic: contact-form emails (and Perfex/WordPress notifications) are sent by your web host using your domain, but the host isn’t in your SPF record and doesn’t sign DKIM. Those messages fail authentication by design.

The fix, in the right order

1. Inventory every sender. List everything that sends email as your domain: mailbox provider, website/CMS, CRM, invoicing, marketing tool, support desk. Miss one and you’ll chase your tail.
2. Publish one clean SPF record covering all of them, and check the lookup count.
3. Enable DKIM signing in every sending system, publishing each selector’s public key in DNS. Use 2048-bit keys where the platform supports them.
4. Add DMARC at p=none with a reporting address, and read the aggregate reports for a couple of weeks. They show you every source sending as your domain — including the ones you forgot in step 1.
5. Tighten DMARC to p=quarantine, then p=reject once the reports show all legitimate mail passing. This is what actually stops spammers from spoofing your domain — and what receivers reward with better inbox placement.
6. Verify like a receiver. Send test mail to a Gmail address, open “Show original,” and confirm SPF, DKIM, and DMARC all say PASS with aligned domains.

How long does it take?

For a typical small-business setup, the DNS work itself is a few hours. The monitoring period is what takes calendar time — two to four weeks of DMARC reports before tightening the policy safely. Rushing to p=reject without the inventory is how legitimate invoices get blocked, so the order matters more than the speed.

If your proposals, invoices, or CRM notifications are landing in spam, this is very likely the layer that’s broken. A free digital systems audit includes an email-authentication check of your domain — SPF, DKIM, and DMARC — with the exact records that need fixing.