The short answer
Business emails usually land in spam because your domain is missing the DNS records that prove your mail is legitimate: SPF, DKIM, and DMARC. Without them, mail providers can't verify you're really you, so they filter or reject your messages. The fix is adding those records correctly, which is a DNS change, not a rewrite of how you email.
Key takeaways
- The most common cause is missing or misconfigured SPF, DKIM, and DMARC records.
- These records live in your domain's DNS and prove your mail is authorized and untampered.
- Without them, providers like Gmail and Outlook increasingly filter or reject your mail.
- Sending from a free address (gmail.com) for business mail also hurts deliverability.
- Fixing the records is a one-time DNS setup that pays off immediately and lastingly.
If your emails keep landing in customers' spam folders, the cause is almost always the same, and it has nothing to do with what you write. Your domain is missing the DNS records that tell mail providers your email is legitimate. Those records are called SPF, DKIM, and DMARC. Without them, Gmail, Outlook, and the rest can't confirm the mail really came from you, so they treat it as suspicious and filter it out.
We're a web studio near Seattle, and email deliverability is one of the most common 'my website is fine but something's broken' calls we get. The reassuring part is that it's usually a fixable configuration issue, not a mystery.
What SPF, DKIM, and DMARC actually do
These three records are how the email world verifies trust. You don't need to master the technical detail, but knowing what each one proves makes the fix make sense.
| Record | What it proves | What happens without it |
|---|---|---|
| SPF | Which servers are allowed to send email for your domain | Providers can't confirm the sender is authorized, so mail looks suspicious |
| DKIM | That the message wasn't altered and really came from your domain | No cryptographic signature, so the mail can't be verified as genuine |
| DMARC | What to do with mail that fails SPF or DKIM, and reports abuse | No policy, so spoofers can impersonate you and providers trust you less |
Think of them as ID checks. SPF says 'these are my authorized senders.' DKIM adds a tamper-proof signature. DMARC ties them together and tells providers how strictly to enforce it. When all three are present and aligned, your mail sails through. When they're missing, you're an unverified stranger.
The usual reasons mail lands in spam, most common first
- 1Missing or broken SPF, DKIM, or DMARC. By far the leading cause. Often the records were never set up, or an SPF record exists but doesn't list your current mail provider.
- 2Sending business mail from a free address. Using a gmail.com or yahoo.com address for business, instead of an address on your own domain, signals low legitimacy and can't be authenticated the same way.
- 3A domain or IP with a poor reputation. If your domain was previously used for spam, or you're on shared infrastructure that got flagged, providers are wary.
- 4Spammy content or formatting. Aggressive subject lines, lots of links, big images with little text, or misleading wording can trip filters even on a well-configured domain.
- 5Sudden sending spikes. Blasting a large list from a domain that normally sends a handful of emails a day looks like a compromised account.
Notice the order. Before you rewrite your emails to sound less 'spammy,' check the records. In our experience the authentication setup is the problem far more often than the wording is.
How to fix it
The fix is a set of DNS changes, made once, at wherever your domain's DNS is managed. It's more careful than hard, and you don't need to change how you actually send email.
- 1Confirm your mail provider. Google Workspace, Microsoft 365, or your host's mail service. Each publishes the exact SPF and DKIM values you need.
- 2Set up SPF. Add a single SPF record listing every service authorized to send mail for your domain. A common mistake is having more than one SPF record, or one that leaves out your real provider.
- 3Turn on DKIM. Enable DKIM in your mail provider's admin settings, then add the key it gives you to your DNS. This adds the signature that proves your mail is genuine.
- 4Add DMARC. Publish a DMARC record. Start with a monitoring-only policy so you can see what's happening, then tighten it once you've confirmed your legitimate mail passes.
- 5Test and wait. DNS changes take a little time to propagate. Send test messages to a Gmail and an Outlook account and confirm they land in the inbox.
Why this is easy to get subtly wrong
The reason deliverability trips up so many businesses is that the records have to be exactly right. A duplicate SPF record, a DKIM key pasted with a typo, a DMARC policy that's too strict before everything's aligned, any of these can quietly hurt rather than help. And because email 'mostly works,' the failures are easy to miss until a customer mentions they found your reply in spam.
That's also why it's worth verifying rather than assuming. Plenty of the domains we check have an SPF record that looks fine but doesn't actually list the provider they switched to a year ago.
How we handle deliverability for clients
Email authentication is part of setting up and maintaining a domain properly, which is why it falls under our maintenance plans starting at $99 a month. We set SPF, DKIM, and DMARC correctly, confirm your legitimate mail passes, and keep the records aligned when you change mail providers or add tools that send on your behalf. It's a quiet piece of infrastructure that makes the difference between your quotes landing in the inbox or the junk folder.
Email going to spam feels like a mystery, but it's usually three DNS records doing their job or not. If your site itself is also acting up, our overview of common website problems is a good next stop.
Related services
More website answers
Every question in this series, from Website Problems, Solved.
Symptoms & emergencies19
- Why Is My Website Down? How to Find Out and Fix It
- Why Does My Website Say "Account Suspended"?
- Error Establishing a Database Connection: What It Means
- Why Is My Contact Form Not Sending Emails?
- White Screen of Death on WordPress: What to Do Now
- Why Is My Website Showing "Not Secure" in Chrome?
- Squarespace Site Not Showing Up on Google? Here's Why
- Why Did Google Remove My Website From Search Results?
- Why Did My Website Traffic Suddenly Drop? Top Causes
- Why Is My Website Sending Spam Emails? What It Means
- Why Is My Website Slow on Mobile but Fast on Desktop?
- Why Does My Website Look Broken on My Phone?
- Why Do My Website Images Look Blurry or Broken?
- How to Tell If Your Website Has Been Hacked: 9 Signs
- "This Site May Be Hacked": How to Remove Google's Warning
- "Deceptive Site Ahead" Warning: How to Fix It Fast
- How to Make Your Website Load Faster
- Why Isn't My Business Showing Up on Google?
- 10 Signs Your Business Website Needs a Redesign
What happens if...9
- What Happens If You Don't Update WordPress Plugins?
- What Happens If Your SSL Certificate Expires?
- What Happens If Your Domain Name Expires? A Timeline
- What Happens If Your Web Host Goes Out of Business?
- What Happens If You Stop Paying Your Web Developer?
- Can an Old Website Hurt Your Google Ranking?
- Is an Outdated Website a Liability for Your Business?
- Why Are My Business Emails Going to Spam? (you are here)
- What Happens If You Don't Maintain Your Website?
Cost & pricing7
- How Much Does It Cost to Fix a Hacked WordPress Site?
- Why Is Website Maintenance So Expensive? A Breakdown
- Hourly Rate vs. Monthly Retainer for Website Updates
- How Much Do Freelancers Charge for Website Maintenance?
- How Much Does WordPress Maintenance Cost Per Month?
- How Much Does Squarespace Maintenance Cost?
- How Much Does Website Maintenance Cost?
Plans & hiring10
- Do I Need a Website Maintenance Plan? An Honest Answer
- Maintenance Plan vs. Pay As You Go: Which Actually Wins
- One-Time Website Fix vs. Ongoing Care: Which Do You Need
- Does a Simple Website Need a Maintenance Plan?
- 12 Questions to Ask a Website Maintenance Company
- Freelancer vs. Agency for Website Maintenance
- What to Look For in a Website Maintenance Contract
- Is Your Website Maintenance Plan a Scam? How to Tell
- Website Maintenance Checklist for Non-Technical Owners
- What Does Website Maintenance Include? (And Why It Matters)
Ownership & switching9
- What Is My Website Built With? How to Check in Seconds
- How to Find Out Who Hosts and Manages Your Website
- Your Web Developer Disappeared: What to Do Now
- How to Switch Web Hosting Without Losing Your Email
- How to Fire Your Web Developer (Without Losing Your Site)
- Can You Maintain Your Own Website Without Coding?
- How Often Should You Update Your Website Content?
- How to Back Up a WordPress Site Yourself (Two Ways)
- Do You Really Own Your Website? How to Check Before You Hire
Platform-specific7
- Do Squarespace Sites Need Maintenance? The Honest Answer
- Do Wix Websites Need Maintenance? What Owners Should Know
- Shopify Maintenance: What Store Owners Actually Need
- WordPress Maintenance Checklist for Non-Developers
- WordPress vs. Squarespace: Which Is Easier to Maintain?
- GoDaddy Website Builder vs. WordPress for Small Business
- How to Keep Your WordPress Website Secure
The Venbit Team
Web design & SEO, Seattle
Venbit is a Seattle-area web design, SEO, and digital marketing studio. Since 2011 we've designed, built, and ranked small-business websites for clients across the Puget Sound and around the country, so the numbers and advice here come from real projects, not a content mill.