Your emails are going to spam.

The short answer

If the emails you send from your business address end up in your customers' spam folders, it's almost always the domain. It's missing the records that say who is allowed to send on its behalf (SPF, DKIM and DMARC), or they're set up wrong. Without them, Gmail and Outlook can't check that the email is yours, so they treat it as suspicious. It's fixed in your domain's DNS, not by switching email software. And every quote that lands in spam is a customer who thinks you never replied.

Why it happens

• SPF, DKIM or DMARC is missing or broken. It's the most common cause. Sometimes there are two SPF records and neither works. Other times the SPF record doesn't include the service that actually sends.
• More than one service sends with your domain. Your office email, your website's form, your invoicing software and your newsletter tool. Each one has to be authorised. Any that isn't ends up in spam or doesn't arrive at all.
• You send from Gmail with your business address. If you write from a Gmail account using your business address, or use Google Workspace without the records in place, the email goes out through Google's servers and your domain hasn't authorised them. To whoever receives it, it looks like spoofing.
• The domain is new. A newly registered domain has no history. If it starts by sending lots of emails at once, filters get suspicious.
• The server is on a blacklist. On shared hosting, another website on the same server may have sent spam. The blacklist penalises all of them.
• Someone is sending spam in your name. Without DMARC, anyone can put your address as the sender. If that happens a lot, your domain loses reputation.

What you can check yourself

• Send an email from your business account to a Gmail account. Open it, click the three dots next to Reply and choose "Show original". At the top you'll see the SPF, DKIM and DMARC results. All three should say PASS.
• In the full headers, look for the "Authentication-Results" line. What you want to see is "spf=pass", "dkim=pass" and "dmarc=pass". A "fail", "softfail" or "none" tells you which one is missing. Google explains how to view the headers in Trace an email with its full headers.
• Use a deliverability testing tool such as mail-tester.com. It gives you an address. You send it one of your usual emails and it tells you what's failing, including whether the server is on a blacklist.
• List everything that sends email with your domain: the office, the website, invoices, newsletters and bookings. It's the first thing needed to fix it.

What Google and Microsoft ask for

Google sets it out in its Email sender guidelines. It asks all senders for SPF or DKIM, an encrypted connection and a low spam rate. Senders of more than 5,000 emails a day to Gmail accounts also need DMARC, a sender address that matches the domain passing SPF or DKIM and one-click unsubscribe in newsletters. Microsoft explains in Email authentication in Microsoft 365 that SPF, DKIM and DMARC work together and that with fewer than all three the protection falls short. A small business doesn't send 5,000 emails a day. But having all three set up properly is what stops it being mistaken for an impersonator.

What not to do

• Don't add a second SPF record. Only one per domain counts. If there are two, both fail. Instead, all the services go into the same one.
• Don't set DMARC to "reject" on day one. If any service is still unauthorised, its emails stop arriving. Start by monitoring, read the reports and tighten it once everything passes.
• Don't switch email provider blindly. If the problem is in the DNS, the new email lands in spam just the same. And if you're moving hosting, first see how to change hosting without losing your email.
• Don't send hundreds of emails at once from a new domain. And never to bought lists. It's the fastest way onto a blacklist.
• Don't pay anyone who guarantees the inbox. The receiver's filter decides. What can be done is to set up the domain the way Google and Microsoft ask.

When to call someone in

If you don't know who manages your domain's DNS, if several different services send with your domain or if the test says you're on a blacklist, it pays to have someone who does this often take a look. One badly written record can leave the whole business without email all at once.

How Vaseia fixes it

• I list everything that sends with your domain and where it sends from.
• I set up one SPF record covering every service, a DKIM signature on each one and DMARC starting in monitoring mode.
• I check with real emails to Gmail and Outlook that they pass SPF, DKIM and DMARC.
• I read the DMARC reports for a few weeks and tighten the policy once nothing is left unauthorised.
• It's the same setup as this website's domain, which sends with SPF, DKIM and DMARC.

If it's your website's form messages that aren't arriving, see also why contact forms don't arrive. And if someone is sending spam from your domain and the website is behaving strangely, your website may have been hacked.

If you'd rather not wrestle with this

Tell me your domain, what you send email with and who is finding it in spam. I'll tell you what's failing and what it takes, with a fixed price before I start. What I can't promise is that no email will ever land in spam again. The filter belongs to whoever receives it. I work remotely, in English, with businesses outside Spain. I don't compete on price. I compete on quality and speed.

Questions