Business emails often reach spam because the sending domain lacks SPF, DKIM or DMARC, a third-party tool sends outside the authorised setup, the visible From domain does not align with authentication, or recipients have marked past messages as unwanted. Check the message headers, list every sending service, fix one SPF record, enable DKIM and begin DMARC in monitoring mode.

A quotation that lands in junk can cost the business more than an email package.

The recipient may never see it. The sender waits for an answer. A competitor responds first.

Email providers judge each message through technical authentication, sending history, content and recipient behaviour. SPF, DKIM and DMARC handle the domain-authentication part. They cannot force delivery, but missing or broken records remove a major trust signal.

Read the message headers before changing DNS

Send a fresh message from the affected business address to a Gmail and an Outlook account.

Open the message headers and find the authentication results. The receiving provider may show entries such as:

spf=pass
dkim=pass
dmarc=pass

A failure gives you a starting point. Common results include:

ResultMeaning
spf=noneThe sending domain has no usable SPF record
spf=failThe sending server is not authorised by the SPF record
dkim=noneThe provider did not sign the message with DKIM
dkim=failThe signature or public key did not validate
dmarc=noneThe domain has no DMARC policy
dmarc=failSPF and DKIM did not produce an aligned pass

Microsoft provides a message-header analyser and a remote connectivity test. Google Workspace administrators can inspect Email Log Search. These tools beat guessing from the inbox placement alone.

SPF lists the systems allowed to send

SPF uses a DNS TXT record to name the mail servers and services that may send for a domain.

A business may send through more systems than it remembers:

  • Google Workspace or Microsoft 365;
  • website contact forms;
  • a CRM;
  • invoicing software;
  • an email marketing platform;
  • support software;
  • an old hosting mailbox.

The SPF record needs to cover each legitimate sender.

A domain must publish one SPF record. Two separate records can produce a permanent error. Adding a second TXT record that starts with v=spf1 does not extend the first one.

SPF also has a DNS lookup limit. Stacking many include values can cross it. Ask the email provider for its current record and remove services the business no longer uses.

SPF checks the envelope sender used during mail transfer. A message can pass SPF while the visible From address shows another domain. DMARC handles that alignment problem.

DKIM signs the message

DKIM adds a cryptographic signature to the email header. The receiving provider looks up the public key in DNS and checks whether the signed parts of the message changed.

Your email provider creates the selector and DNS record. You publish the record and enable signing in the provider’s control panel.

DKIM often survives forwarding better than SPF because a forwarding server changes the sending IP, while the original signature can remain valid. Mailing lists, security gateways and footer tools can still break DKIM if they modify signed content.

Use a 2048-bit key where the provider supports it. Google requires at least 1024 bits for mail sent to personal Gmail accounts and recommends 2048 bits.

DMARC checks alignment and reports failures

DMARC asks whether the domain shown to the recipient aligns with a domain that passed SPF or DKIM.

The revised DMARC standard became RFC 9989 in May 2026. It replaced RFC 7489 as the core specification.

A new business should begin with a monitoring policy:

v=DMARC1; p=none; rua=mailto:[email protected]

Replace the reporting address with a mailbox or reporting service that can process aggregate reports.

A p=none policy asks receivers to send reports without requesting quarantine or rejection. Use those reports to find legitimate services that fail authentication.

Move toward quarantine or reject after the business has identified its senders and corrected alignment. Publishing p=reject on day one can block invoices, forms and CRM messages that the business forgot to include.

The visible From domain needs to align

A business may send an invoice from [email protected] through software that signs with the software provider’s domain.

The message can pass DKIM for the provider and still fail DMARC for company.co.za.

Ask the service whether it supports:

  • custom DKIM for your domain;
  • a custom return-path or bounce domain;
  • domain verification;
  • SPF instructions.

Use a dedicated subdomain for a marketing or transactional system when the provider cannot align with the main domain. That choice isolates the setup and gives the business clearer reports.

Authentication does not excuse poor sending practice

Google requires all senders to Gmail accounts to use SPF or DKIM. Bulk senders face stronger requirements that include SPF, DKIM, DMARC, domain alignment and one-click unsubscribe for subscribed messages.

A small business sending quotations will sit below bulk thresholds, but the same controls protect the domain.

Inbox placement can still suffer when the business:

  • sends to purchased lists;
  • keeps emailing invalid addresses;
  • hides the unsubscribe route on marketing mail;
  • uses misleading subjects;
  • sends large attachments with little context;
  • produces sudden volume from a new domain;
  • receives spam complaints.

Keep marketing mail separate from one-to-one client communication. A campaign platform should not share every reputation signal with the mailbox used for quotations and support.

Website forms need their own authentication check

A website may send notifications as if they came from the visitor:

From: [email protected]

That setup asks the website server to impersonate Gmail and can trigger authentication failures.

Use a sender on the website’s own domain:

From: Website Enquiries <[email protected]>
Reply-To: [email protected]

Then authorise the form service through SPF or DKIM.

Test the form after any DNS, hosting or email change. A working mailbox does not prove that website notifications use the same route.

A practical repair order

  1. Send tests to Gmail and Outlook.
  2. Read the authentication headers.
  3. List every system that sends for the domain.
  4. Publish one complete SPF record.
  5. Enable DKIM for each supported sender.
  6. Add DMARC with p=none and reporting.
  7. Correct alignment for forms, CRM and invoices.
  8. Remove old services from DNS.
  9. Watch bounces, complaints and DMARC reports.
  10. Tighten the DMARC policy after clean monitoring.

DNS changes need time to spread, but you can test the records as soon as authoritative name servers return them.

Keep control of the domain

SPF, DKIM and DMARC live in DNS. The business needs access to the domain and DNS account, even when a web designer or IT provider manages the records.

Document:

  • the registrar;
  • the DNS host;
  • the email provider;
  • the sending services;
  • the SPF record;
  • each DKIM selector;
  • the DMARC reporting address.

That record prevents a future supplier change from breaking mail.

IDJOY can connect a branded email setup with the domain, website forms and DNS records. Start a business email enquiry if client messages need a cleaner route.