Blog · Email

Why your business email lands in spam — and the DNS records that fix it

By the HostingAlly team Published 27 July 2026 7 min read

There's a particular sinking feeling when a customer says "found it in spam." Your invoice, your quote, your carefully written proposal — filed next to the pills and the princes. For small businesses sending from their own domain, the cause is rarely the content of the mail. It's almost always authentication: your domain isn't proving, cryptographically, that the mail is really from you.

Since Google and Yahoo tightened bulk-sender rules in 2024 — requirements that have only ratcheted since — unauthenticated mail doesn't get the benefit of the doubt anymore. The good news: authentication is three DNS records, they're free, and the whole job fits in twenty minutes.

The three records, in plain English

SPF is the guest list: a DNS record naming which servers are allowed to send mail for your domain. A receiving server checks the sender's IP against it; mail from anywhere else fails. One record, one line — the SPF walkthrough writes it with you.

DKIM is the wax seal: your mail server signs each outgoing message with a private key, and the public half sits in your DNS for receivers to verify. A valid signature proves the message wasn't forged or altered in transit. Enabling it is a panel toggle plus one record.

DMARC is the instruction card: it tells receivers what to do when SPF and DKIM fail — deliver anyway, quarantine, or reject — and where to send reports. Gmail effectively expects one from any domain that wants inbox placement. Start at p=none to observe, then tighten the policy once reports look clean.

The mistakes that keep authenticated mail in spam

Sending application mail through the wrong path: your WordPress contact form or invoicing app sending 'from' your domain via a server that isn't in your SPF record fails authentication on every message. The fix is routing application mail through authenticated SMTP — the WordPress version takes ten minutes.

Multiple SPF records: domains may have exactly one. A second one (often left behind by an old provider) makes SPF permanently fail. Merge them into a single record.

Free-webmail 'from' spoofing: sending as you@yourdomain via a personal Gmail's 'send as' without proper SMTP authentication fails DMARC at every strict receiver. Send domain mail through the domain's own mail service.

And the non-DNS factor: engagement history. A domain that suddenly bursts from zero to hundreds of identical messages looks like a compromised mailbox. Warm up new domains gradually, and keep transactional sending (invoices, receipts) separate in volume terms from any marketing blasts.

The 20-minute checklist

One: list everything that legitimately sends as your domain — the mailbox itself, your website's forms, your invoicing tool. Two: publish one SPF record covering exactly that list. Three: switch on DKIM signing at your mail host and publish the key. Four: publish DMARC at p=none with a reporting address, wait a week, read the reports, then move to quarantine. Five: send a test to a Gmail address and use 'Show original' — three green PASS lines is the goal.

On our email hosting, SPF and DKIM records are pre-generated for every mailbox domain and the panel shows exactly what to publish — most of the twenty minutes is reading. Spam filtering on inbound mail is included on every plan, and for domains with serious filtering needs there's dedicated mail filtering in front of any mailbox, hosted anywhere.

Quick answers

Why do my business emails go to spam even though they're not spam?

Almost always missing authentication: without SPF, DKIM and DMARC records, receiving servers can't verify the mail is really from your domain, and since the 2024 Gmail/Yahoo rules unauthenticated mail is demoted by default. Content matters far less than owners assume.

What are SPF, DKIM and DMARC in simple terms?

SPF is a public list of servers allowed to send your domain's mail. DKIM is a cryptographic signature proving each message is genuine and unaltered. DMARC tells receivers what to do when those checks fail, and sends you reports. Together they're the difference between inbox and spam folder.

How long until deliverability improves after adding the records?

Authentication takes effect as soon as DNS propagates — hours. Reputation recovery takes longer: expect steady improvement over two to four weeks of consistent, authenticated sending.