Why Are My Business Emails Going to Spam? SPF, DKIM and DMARC Explained

Few things hurt a small business more quietly than emails that never get read. The quote you sent on Monday is sitting in the customer's spam folder, and nobody tells you. In most cases the reason is not the wording of the email but missing or broken email authentication: three DNS records called SPF, DKIM and DMARC. Here is what each one does, in plain language, and how to get them right.

Why authentication matters more every year

Anyone can write any "From" address on an email, which is exactly how fake invoice and fake M-Pesa scams work. To protect their users, Gmail, Outlook and Yahoo now check whether a message really comes from the domain it claims. Since 2024, Gmail and Yahoo require every sender to pass SPF or DKIM, and bulk senders to have all three records. Mail that fails is far more likely to land in spam or be rejected.

SPF: the list of approved senders

SPF (Sender Policy Framework) is a TXT record on your domain that lists which servers may send email for it. A typical record looks like this:

v=spf1 include:<your email provider> ~all

The include: parts name approved services, and ~all asks receivers to treat anything else as suspicious. Rules to remember:

• Only one SPF record per domain. Two records make SPF fail completely.
• Add every service that sends as you: your email provider, your website if it sends order emails, and any newsletter or invoicing tool.
• Stay under 10 lookups. Each include: can trigger more lookups behind the scenes. Remove services you no longer use.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) signs each message with a private key held by your email provider. The matching public key is published in your DNS. The receiving server checks the signature: if it matches, the message really came from your domain and was not altered on the way. A good email service signs your mail automatically; you only need to publish the record it gives you.

DMARC: the policy and the reports

DMARC ties SPF and DKIM together. It tells receivers what to do when a message claiming to be from your domain fails both checks, and it sends you reports showing who is sending mail as you. Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:[email protected]

Add it as a TXT record on the host _dmarc. After a few weeks of clean reports, move to p=quarantine (failing mail goes to spam) and finally p=reject (failing mail is refused). At that point, criminals can no longer send convincing fake invoices from your domain.

Other reasons emails land in spam

• Your website sends mail the wrong way. Contact forms and online shops that send with the server's built-in mail function often fail SPF and DKIM. Configure your website to send through your email account over secure SMTP instead.
• Your address or server is on a blacklist. Check with our free email blacklist checker.
• The content looks like spam. All-image emails, link shorteners, ALL CAPS subjects and attachments from a new address all add risk.
• Sudden bursts. Sending hundreds of identical messages from a normal mailbox looks like spam. Use a proper newsletter tool for mass mailing.

A quick checklist

1. One SPF record that includes every service that sends as you.
2. DKIM switched on with your email provider and its record published.
3. A DMARC record, starting with p=none.
4. Website forms sending over SMTP with a real mailbox.
5. Your domain and mail server checked against blacklists.

With Hostiko Business Email, DKIM signing is built in, outbound filtering protects your sending reputation, and your setup page lists the exact SPF and DKIM records for your domain, ticking each one off as it goes live. See the step-by-step guide to setting up business email on a .co.ke domain.