Why Your Emails Keep Landing in Spam — and the Three DNS Records That Fix It

A builder in Bristol sends a quote to a customer on Tuesday morning. By Thursday the customer says nothing arrived. It did arrive — it landed in the spam folder, along with the invoice, the appointment reminder and the follow-up. Three jobs quietly lost, and nobody rang a bell to say so.

This happens to perfectly honest businesses all the time, and the cause is almost never the words in the email. It's about whether receiving servers can tell who you are. Here's the plain-English version, and what to do about it.

First, the uncomfortable truth

Mailbox providers like Gmail, Outlook and Yahoo decide where your message lands based on reputation and authentication. Reputation is built over months: do people open your mail, reply to it, move it out of spam, or mark it as junk? Authentication is a set of technical records in your domain that prove the message genuinely came from you.

Most small businesses have never touched the second one. That's the bit we can fix this week.

SPF: the guest list

SPF (Sender Policy Framework) is a DNS record that lists every service allowed to send email on your domain's behalf. If your website host, your invoicing tool and your email provider all send mail as you, they all need to appear on that list.

It's one long line of text starting with v=0 and ending with something like ~all, which is shorthand for 'anything not on the list is probably dodgy'. Two practical warnings: keep the number of lookups under ten, because the list is capped, and check it whenever you add a new tool. A missing entry is the single most common cause of 'my form enquiries never arrive'.

DKIM: the wax seal

DKIM adds a cryptographic signature to every message, so the receiving server can verify nothing was tampered with in transit and that the mail really came from your domain. It's usually a case of turning it on in your email provider, CRM or website host, then copying a record into your DNS.

If your provider offers a choice of key lengths, take 2048-bit. If you're on a shared platform, check whether you're sending as yourbusiness.co.uk or as a shared subdomain — signing your own domain is what protects your name specifically.

DMARC: the instruction manual

DMARC is the policy record that ties the first two together. It tells receiving servers what to do when a message fails both SPF and DKIM — nothing, quarantine it, or reject it — and where to send reports.

Start with p=none. That's monitoring mode: mail still flows, but you receive reports showing who's sending as your domain. Give it four to six weeks, read the reports (digest services turn them into something human), then move to p=quarantine and eventually p=reject. Jumping straight to reject without checking first is how businesses accidentally block their own booking confirmations.

Ten-minute checks you can run yourself

You don't need an IT team for this. You need a browser and a test email.

1. Look up your records. Free checkers such as MXToolbox or Google's Admin Toolbox will show your SPF and DMARC records and flag syntax errors. If there's nothing there, that's your answer.
2. Send a real test. Send from your normal address to a Gmail account and an Outlook account you control. In Gmail, open the message and use 'Show original' to see SPF, DKIM and DMARC results line by line.
3. Check blacklists. The same lookup tools will scan major blocklists in seconds. If you're listed, find out why before you appeal.
4. Check your domain age and sending history. A brand-new domain sending 500 newsletter emails on day one looks suspicious. Start small.

Send from your own domain

If quotes go out from a free webmail address or a generic shared sending domain, you've given up the reputation you spent years building. Send from [email protected], keep marketing mail on a clearly separate subdomain if volume is high, and make sure the 'From' name is your actual business, not 'noreply'.

List hygiene is half the battle

A clean list isn't about having more contacts. It's about having contacts who expect to hear from you.

• Remove hard bounces immediately — they never recover.
• If someone hasn't opened anything in nine to twelve months, run a short re-engagement sequence and then let them go.
• Use confirmed (double) opt-in for newsletters. It costs you a few sign-ups and saves you a reputation.
• Never buy a list. Not once. It's the fastest route to a burnt domain.

Unsubscribe clarity and the rules

Under UK PECR and UK GDPR, people need a straightforward way to opt out, and you need to honour it promptly. Practically, that means a visible unsubscribe link in every marketing email, one click, no login wall, no 'email us to be removed'. Purchase-related messages are treated differently from marketing, but the habit of clarity is worth keeping across the board.

Bulk senders to Gmail and Yahoo also need one-click unsubscribe and to keep spam complaint rates under roughly 0.3%. Above that, filtering gets aggressive fast — and it's much harder to climb back than to stay clean.

Reputation housekeeping that pays off

Warm up new domains slowly. Keep your sending volume steady rather than spiking once a quarter. Sign up for Google Postmaster Tools if you send any real volume — it shows your domain reputation and spam rate for free. And don't send an email that's one giant image with no text alternative, because that pattern still looks like the spam it so often is.

What good looks like

When everything's in order, your quote lands in the inbox, your invoice doesn't need chasing and your booking confirmations actually get read. It's unglamorous plumbing, but it's the difference between a customer seeing your name and never knowing you got in touch.

Start with the SPF check today. It takes about four minutes, and it's the one most likely to be broken.