You’ve sent a quote to a new client and heard nothing back. A customer says they never got their order confirmation. Enquiries from your website’s contact form seem to have dried up. More often than you’d think, the cause is the same: your emails are quietly landing in spam – or not arriving at all.
The good news is that it’s usually fixable. In most cases it comes down to three settings on your domain called SPF, DKIM and DMARC. They sound technical, but the idea behind them is simple, and getting them right can make a real difference to whether your emails reach the people you’re writing to.
Why are my emails going to spam?
Email was never designed with security in mind. By default, anyone can send an email that claims to come from your domain – which is exactly how scammers send convincing fake invoices and phishing emails in other people’s names.
To fight this, the big email providers have become much stricter about checking who an email really comes from. Since February 2024, Google and Yahoo have required anyone sending email to their users to authenticate it, with tougher rules for businesses sending 5,000 or more emails a day. Microsoft followed in May 2025 for Outlook.com and Hotmail addresses.
Even if your business sends nowhere near 5,000 emails a day, the direction of travel is clear. Emails that can’t prove where they’ve come from are increasingly treated with suspicion – sent to spam, delayed or rejected outright. If your domain’s authentication isn’t set up properly, your perfectly genuine emails can end up looking just like the fakes.
SPF, DKIM and DMARC explained
All three are small text records added to your domain’s DNS settings – the same place that tells the internet where your website and email live. Each one does a different job, and they work best together.
SPF: who’s allowed to send
SPF (Sender Policy Framework) is a list of the services allowed to send email on behalf of your domain. Think of it as a guest list. If your business uses Microsoft 365 for everyday email, Mailchimp for newsletters and your website for form notifications, all three need to be on the list. When an email arrives from a service that isn’t, the receiving server has good reason to be suspicious.
DKIM: proof it’s genuine
DKIM (DomainKeys Identified Mail) adds a digital signature to every email you send. The receiving server checks that signature against a key published on your domain. If it matches, it knows the email really came from you and hasn’t been tampered with along the way. It’s a bit like a wax seal on a letter.
DMARC: what to do when checks fail
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together. It tells receiving servers what to do with an email that fails the checks – let it through, send it to spam or reject it – and it can send you reports showing who’s sending email using your domain.
Most businesses start with a DMARC policy that simply monitors, then tighten it once they’re confident all their genuine email is passing. Going straight to a strict policy without checking first is a common way to accidentally block your own emails.
Don’t forget your website
It’s easy to think of email as just the messages you send from Outlook or Gmail, but your website sends email too. Contact form enquiries, order confirmations, password resets and booking notifications are all emails sent automatically by your website – often called transactional emails.
This is where we see problems most often. Many websites, particularly WordPress sites, send email straight from the web server by default. Those emails usually aren’t covered by your SPF record and aren’t signed with DKIM, so they’re exactly the kind of message email providers are now cracking down on. The result is enquiries sitting unseen in a spam folder, or customers who never receive their receipts.
The fix is to send your website’s emails through a proper transactional email service that’s authenticated for your domain. It’s a small change behind the scenes, but it makes your website’s emails far more reliable.
It’s also worth knowing that authentication isn’t always the end of the story. Many larger organisations use email security filters, such as Mimecast, that scan every incoming email and the links inside it. Some transactional email services rewrite links so they pass through a tracking address first, to count clicks. To a security filter, that can look a lot like a phishing link, so the email gets held or quarantined. Some filters even “click” links to check them, which can use up one-time links like password resets before the person ever sees them. For form notifications, receipts and password resets, it’s usually best to turn link tracking off altogether.
How to check your email setup
You don’t need to be technical to get a rough idea of where you stand. Here’s where to start:
- Run a free check. Enter your domain in our email security checker to see whether SPF, DKIM and DMARC are in place. It’s free, with no sign-up.
- List everything that sends email for you. Think beyond your inbox – your website, newsletter platform, accounting software, booking system and CRM may all send email using your domain. Each one needs to be covered.
- Check your website’s emails. Send yourself a test enquiry through your contact form and see where it lands. If it goes to spam, or takes a long time to arrive, that’s a sign it needs looking at.
- Make changes carefully. A domain can only have one SPF record, and a small typo can stop email working altogether. If you’re not confident editing DNS settings, it’s worth getting help.
It’s also worth checking again whenever you start using a new service that sends email, as this is one of the most common reasons a setup that was working stops working.
Getting your emails back in the inbox
Email authentication isn’t the most exciting part of running a business, but it’s one of those things that quietly makes everything else work. A few correctly set-up records can be the difference between a new enquiry reaching you and it disappearing without a trace.
At 37 Digital, we set up and check SPF, DKIM and DMARC as part of our email migration and support work, whether you’re on Microsoft 365, Google Workspace or something else. We also run our own transactional email service, so your website’s form notifications and order emails are properly authenticated – and it works with any website, wherever it’s hosted. For clients on our managed web hosting, we can take care of the lot.
If you think your emails might be going astray, get in touch and we’ll take a look.
Updated 23 October 2026: we’ve added a link to our free email security checker, which launched after this article was first published.
