Why Your Business Emails Land in Spam (and How SPF, DKIM, and DMARC Fix It)

You hit send on an invoice reminder, a quote, or your monthly newsletter — and your customer never sees it. No bounce, no error, just silence. It went to spam.

If this sounds familiar, you are not alone. Gmail, Yahoo, and Outlook now reject or spam-folder mail from domains that have not set up three DNS records: SPF, DKIM, and DMARC. Since February 2024, bulk senders (roughly 5,000 or more messages a day to Gmail accounts) must authenticate with all three, offer one-click unsubscribe, and keep spam complaints under 0.3%. Enforcement ramped up through 2025, and in 2026 even low-volume business senders feel the impact: without authentication, your quotes, invoices, and appointment confirmations are far more likely to be flagged.

The good news: fixing this takes about an hour, costs nothing, and permanently improves deliverability. Here is what each record does, how to set them up, and the mistakes that keep small businesses in the spam folder.

What SPF, DKIM, and DMARC Actually Do​

Think of these three records as ID checks for your email. Each answers a different question a receiving server asks before delivering your message.

SPF: which servers may send for your domain​

SPF (Sender Policy Framework) is a TXT record in your domain's DNS that lists every server allowed to send mail as you. When Gmail receives a message claiming to be from [email protected], it looks up your SPF record and checks whether the sending server's IP is on the list.

Example SPF record for a business using Google Workspace plus an invoicing tool:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

• v=spf1 identifies the record as SPF.
• Each include: authorizes a provider's servers.
• ~all (soft fail) tells receivers to treat non-listed servers with suspicion; -all (hard fail) tells them to reject outright.

SPF alone is not enough, because it only validates the envelope sender (the hidden Return-Path), not the address your customer sees in the From field. Forwarding also breaks SPF. That is why you need DKIM too.

DKIM: a tamper-proof signature on every message​

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the headers of every outgoing message. Your sending provider holds a private key; you publish the matching public key as a DNS TXT record. The receiving server verifies the signature to confirm the message really came from your domain and was not altered in transit.

Unlike SPF, DKIM survives forwarding, which makes it the more durable of the two signals. Google requires bulk senders to have both SPF and DKIM passing, with at least one of them aligned to the From domain.

Setting up DKIM usually means:

1. Turning on DKIM signing in your provider (Google Workspace, Microsoft 365, Mailchimp, and similar tools all have a one-click enable step).
2. Copying the TXT record they give you (a selector plus a long public key) into your DNS.
3. Waiting for propagation, then verifying in the provider dashboard.

DMARC: your policy for what happens when checks fail​

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It is a TXT record at _dmarc.yourdomain.com that tells receiving servers what to do when a message claiming to be from you fails authentication — and where to send you reports about it.

A starter DMARC record in monitoring mode:

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100;

• p=none means take no action yet, just send reports. Start here.
• rua= is where aggregate reports go. Use a mailbox you actually check.
• Once legitimate mail passes consistently, move to p=quarantine (send failures to spam), then p=reject (block them). That progression is what stops spoofers from impersonating your domain.

DMARC also requires alignment: the domain in the From header must match the domain that passed SPF or DKIM. This is the step many businesses miss — SPF and DKIM can both show "pass" while DMARC still fails because the domains do not line up.

The Gmail and Yahoo Rules You Must Meet​

Even if you never send 5,000 messages a day, treat these as your baseline. Gmail counts all mail from the same primary domain (including subdomains) toward the bulk threshold, bulk status never expires once assigned, and every sender — bulk or not — is expected to authenticate.

Here is the practical checklist for 2026:

• Authenticate with SPF or DKIM at minimum; both if you send bulk. Bulk senders need SPF and DKIM plus a published DMARC record (at least p=none) with From-domain alignment.
• Keep spam complaints under 0.3%. Google Postmaster Tools shows your rate; sustained rates above 0.3% trigger filtering. Aim to stay well under 0.1%.
• Make unsubscribing easy on marketing mail. Include a visible List-Unsubscribe header supporting one-click unsubscribe, and honor requests within two days.
• Use valid forward and reverse DNS, and a consistent From domain. Do not send business mail from free-mailbox addresses or ever-changing From names.
• Do not impersonate Gmail headers or buy lists. Unsolicited mail drives the complaints that sink your reputation fastest.

Yahoo and Outlook enforce substantially the same set, so one correct setup covers all three.

Setting It All Up in About an Hour​

You do not need to be technical to do this — you just need access to your DNS host (where you bought your domain or where your nameservers point) and admin access to your mail provider.

Step 1: Inventory who sends mail as you​

List every service that sends email using your domain: your mailbox provider, your website contact form, your invoicing or booking system, your newsletter tool, your CRM. Each one needs to be in SPF or covered by its own DKIM signature. Miss one and its mail starts failing.

Step 2: Publish SPF without breaking the 10-lookup limit​

SPF has a hard limit of 10 DNS lookups. Each include: can trigger several, and stacking providers (mailbox + marketing + helpdesk + invoicing) can silently push you over — at which point SPF returns an error and receivers treat it as a fail.

• Start from your provider's recommended record; do not merge random snippets from blog posts.
• Keep all sending sources in a single SPF TXT record at the root domain. Multiple SPF records invalidate all of them.
• If you are near the limit, ask providers for flattened includes or remove services you no longer use.
• Validate with a free SPF checker before moving on.

Common SPF setup:

Step 3: Enable DKIM everywhere you send​

Turn on DKIM signing in each sending platform and publish each selector record it gives you. A domain often ends up with several DKIM selectors (one per provider) — that is normal. Verify each one shows as active in the provider console, and send a test to a Gmail address to confirm the Authentication-Results header shows dkim=pass.

Rotate keys when your provider prompts you; broken rotations show up as gradual deliverability decay, so confirm the new key validates before removing the old one.

Step 4: Publish DMARC in monitor mode, then enforce​

1. Publish _dmarc with p=none and a rua= address.
2. Watch aggregate reports for two to four weeks. Free DMARC report readers turn the XML into readable tables showing which servers pass and which fail.
3. Fix every legitimate source that fails (usually a missing DKIM signature or an alignment mismatch).
4. Move to p=quarantine, watch another cycle, then move to p=reject.

Skipping straight to p=reject on day one is the most common self-inflicted outage in this whole process — legitimate invoices and receipts get blocked because one overlooked sender was never authenticated.

7 Mistakes That Keep Small Businesses in Spam​

1. No SPF, DKIM, or DMARC at all. Still the most common finding on small-business domains. Check yours with any free authentication tester before assuming your provider "handled it."
2. Two SPF records. DNS allows only one. Merge everything into a single TXT record starting with v=spf1.
3. SPF over the lookup limit. Too many includes means SPF errors out. Audit yearly and drop dead providers.
4. DKIM enabled in the app but never published in DNS. The signing toggle without the TXT record does nothing.
5. DMARC failing on alignment. SPF or DKIM passes but under a different domain than your From address — common when newsletters send from a provider's domain instead of yours. Configure a custom sending domain so alignment passes.
6. Nobody reads DMARC reports. The rua= mailbox fills up, warnings about a failing new tool go unnoticed, and the problem surfaces only when customers complain.
7. List hygiene and content undo good authentication. Bought lists, no unsubscribe link, misleading subject lines, and image-only emails generate the complaints that tank reputation even with perfect DNS.

How to Tell It Worked​

• Send test mail to Gmail, Yahoo, and Outlook addresses (including a fresh account that has never engaged with you) and confirm inbox placement, not spam.
• Inspect headers. In Gmail, open the message, choose Show original, and confirm spf=pass, dkim=pass, and dmarc=pass with your domain aligned.
• Enroll in Google Postmaster Tools. Add your domain, verify ownership, and watch spam rate, authentication pass rates, and reputation over the following weeks.
• Track real metrics. Compare open rates, reply rates, and — most importantly — customer "I never got your invoice" complaints before and after the change.

What This Has to Do With Your Books​

Email deliverability is a cash-flow issue disguised as an IT chore. When invoices land in spam, customers pay late through no fault of their own, your days-sales-outstanding creeps up, and you waste hours chasing payments that were never seen. The same applies to quotes that never get answered and payment-reminder sequences that fire into the void.

Treat authenticated sending domains the way you treat bank reconciliation: a boring control that keeps money moving. Log which provider sends what (invoices, receipts, marketing) so each stream stays authenticated, and track late payments against the date the customer actually saw the invoice — not just the date your system sent it. Clean delivery records make both your follow-up and your books more honest.

For more on keeping receivables tight, see the /docs/ guides on invoicing workflows and the /fava/ dashboard views that surface overdue balances at a glance.

Simplify Your Financial Management​

Once your invoices reliably reach the inbox, make sure what happens next is just as clean: clear records of what was billed, paid, and outstanding. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and keep every dollar traceable from invoice to ledger.