Why Are My Emails Going to Spam? SPF, DKIM, and DMARC Explained for Small Business Owners
An invoice you sent never gets opened. An appointment confirmation a customer swears they never received. A newsletter that used to land fine suddenly doesn't. The email went out - your outbox says so - but somewhere between your server and the customer's inbox, it got quietly filed under spam instead of delivered. More often than not, the actual wording of the email has nothing to do with it. The real cause usually lives in three DNS records most business owners have never heard of: SPF, DKIM, and DMARC.
Inbox providers aren't grading your writing - they're checking your ID
It's tempting to assume spam filtering is mostly about content: too many exclamation points, the word "free," a sketchy-looking link. That's part of it, but for a real business sending real invoices and appointment reminders, it's usually not the deciding factor. The bigger question Gmail, Outlook, and every other major inbox provider ask first is simpler: can we prove this message actually came from the domain it claims to be from? If the answer is no, or "not sure," the message gets treated with more suspicion by default - regardless of how professional it reads. SPF, DKIM, and DMARC exist to answer that question with a yes.
The three records inbox providers check before they trust you
1SPF - Sender Policy Framework
A DNS record for your domain that lists which mail servers are allowed to send email on its behalf - your website's hosting, your invoicing software, your email marketing tool, whatever actually sends mail as you@yourbusiness.com. When a message arrives, the receiving inbox checks the sending server against that list. Not listed means the message looks like it could be forged, even when it isn't.
2DKIM - DomainKeys Identified Mail
A digital signature attached to outgoing mail, created with a private key only your mail-sending service holds and verified against a matching public key published in your DNS. It proves two things at once: the message was sent by a server you actually authorized, and nothing in it was altered along the way.
3DMARC - Domain-based Message Authentication, Reporting and Conformance
A policy record that tells inbox providers what to do when a message fails SPF or DKIM - deliver it anyway, send it to spam, or reject it outright - and where to send reports about mail claiming to be from your domain. Without it, SPF and DKIM exist but have no enforcement behind them, and nobody's watching who's using your name to send mail.
A business switches invoicing software, booking platforms, or email marketing tools - or a web person sets one up on their behalf - and nobody adds the new service to the SPF record or turns on DKIM signing for it. The invoices go out, look completely normal, and land in spam anyway, because as far as the receiving inbox can tell, an unrecognized server is sending mail pretending to be yourbusiness.com.
Every service that sends email as your domain - hosting, invoicing, booking, marketing - is explicitly listed in your SPF record and signs its mail with DKIM. A DMARC record is in place telling inbox providers what to do if something doesn't match, and someone checks the reports it generates occasionally rather than never.
Why this trips up small businesses specifically
A single-employee business can easily have four or five different tools sending email "as" the business without anyone thinking of it that way: the website's contact form, an invoicing app, an appointment scheduler, a CRM's automated reminders, and a separate email marketing platform for the newsletter. Each one is a separate sender that needs its own authorization. It's common for the original setup - done at launch, maybe years ago - to cover only whatever was in use at the time, with nothing added as new tools got layered on since. A domain or hosting move can also quietly wipe these records out if whoever handled the migration didn't know to carry them over (the same kind of DNS handoff gap covered in Domain and Hosting Expiration Explained), which is one more reason a hosting or domain change is worth double-checking rather than assuming everything just came along for the ride.
A plain-English checklist for what to check or ask about
1Find out who manages your domain's DNS records
Usually your domain registrar or web host, sometimes a separate DNS provider. This is where SPF, DKIM, and DMARC records live, and where any fix actually gets made.
2Check whether the records exist at all
A free SPF/DKIM/DMARC checker tool can look up your domain's public DNS in seconds and show what's published. It's common to find nothing published at all, which is itself the answer.
3List every service that sends email as your domain
Website contact forms, invoicing software, booking systems, CRMs, and marketing platforms all count. Confirm each one is actually authorized in your SPF record and, ideally, signing with DKIM.
4Ask your host or IT person to add or update the records
This is usually a short task for someone with DNS access - often the same person or company already handling your hosting or domain.
5Keep expectations realistic
Correct SPF, DKIM, and DMARC records remove one real obstacle to inbox placement - they don't guarantee it. Content, sending volume, how many recipients mark a message as spam, and list hygiene all still play a role, the same way a clean driving record helps an insurance rate without being the only factor.
Where this fits with a website audit
Our free audit looks at the site itself - speed, SEO, accessibility, and security signals like SSL - and can't see your domain's SPF, DKIM, or DMARC records, because email authentication isn't part of how a website loads or ranks; it's a separate, invisible-from-the-outside DNS setting, the same way a backup or a hosting renewal date is. What it can do is catch the parts of your site's health that are visible, so this is one more thing worth checking on your own alongside it - not because anything is necessarily wrong, but because it takes a few minutes to find out either way.
Frequently asked questions
What is SPF and why does it matter for my business emails?
SPF (Sender Policy Framework) is a DNS record for your domain that lists which mail servers are allowed to send email claiming to be from you. When an inbox provider receives a message from yourbusiness.com, it checks that record - if the sending server isn't on the list, the message looks like it could be forged, and spam filtering gets more aggressive.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing email, generated from a private key only your mail provider holds, and checked against a public key published in your DNS. It proves two things: the message really was sent by a server you authorized, and nothing in it was altered in transit.
What is DMARC and do I need it?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells inbox providers what to do when a message fails SPF or DKIM - let it through, mark it as spam, or reject it - and where to send reports about the mail claiming to be from your domain. It's not required for email to work, but without it your SPF and DKIM records have no enforcement behind them, and you have no visibility into who's sending mail using your name.
Why are my emails going to spam if I didn't do anything wrong?
Usually because nobody set these DNS records up when the mailbox or a sending tool was added, not because of anything in the message itself. A new invoicing tool, booking system, or email marketing platform that sends "as" your domain needs to be explicitly authorized in your SPF record and signing with DKIM - if it isn't, inbox providers have no way to confirm the mail is legitimate, and treat it with more suspicion by default.
How do I check my domain's SPF, DKIM, and DMARC records?
A free SPF/DKIM/DMARC checker tool (searching that phrase turns up several reputable ones) can look up your domain's public DNS records in seconds and show you what's published, if anything. If nothing shows up, or you don't recognize which mail services are listed, that's exactly what to bring to whoever manages your hosting, domain, or email.
Find out where your site actually stands - free
Email authentication isn't something an audit can see, but a lot of what quietly puts a site at risk is. Enter your address below and we'll email you a plain-English report within the hour. If something's fixable on our end, it's a flat $149 for your fixable speed/image/SEO/broken-link issue, or $299 for everything, with before-and-after proof once it's done.