Why your business email goes to spam, and the three records that fix it

The short version

Mail systems assume a message is fake unless it can prove otherwise. Three DNS records give that proof. If they are missing, Gmail and Outlook quietly file your mail as suspicious, and your customer never sees the quote you sent.

What each record actually does

SPF — who is allowed to send

SPF is a list of the servers allowed to send email using your domain name. When your message arrives, the receiving system looks up that list. If the sender is not on it, that is a bad sign.

Common mistake: listing your office and your email provider, but forgetting your website. Your contact form sends mail too.

DKIM — a seal that proves nothing was changed

DKIM adds an invisible signature to each message. The receiver checks it against a key published in your DNS. If they match, the mail genuinely came from you and was not altered.

Your email provider generates this for you. Turning it on is usually one switch plus one record to paste.

DMARC — what to do when the first two fail

DMARC tells receivers what you want done with mail that fails SPF and DKIM: nothing, send to spam, or reject. It also emails you a weekly summary of who is sending mail as your domain.

Start with the gentlest setting so you can watch the reports without risking real mail. Tighten it after a few weeks.

The one most people miss

Servers that support modern internet addressing often send over IPv6. Many SPF records only list the older IPv4 address. The mail then fails SPF for that reason alone, even though everything else was set up correctly.

If your server has both kinds of address, both belong in your SPF record.

How to check yours

Send a message from your business address to a personal Gmail account. Open it, use "show original", and look for three lines saying SPF, DKIM and DMARC. All three should say pass. If any says fail, softfail or none, that record needs work.