Why your business email lands in spam: SPF, DKIM and DMARC explained

Few things quietly cost a business more than email that does not arrive. Quotes that never land, invoices that vanish into a client's junk folder, replies that never come because your message was never seen. Nine times out of ten the cause is not your words or your server, it is three little records on your domain that prove your email is genuinely from you. They are called SPF, DKIM and DMARC, and when they are missing or wrong, the world's mail systems treat your business like a stranger. Here is what each one does, in plain English, and how to put them right.

The real problem: mail servers cannot tell it is you

Email was built in a trusting age, when anyone could put any name on a message and it would be believed. Scammers abused that for decades, so the receiving mail systems, the ones at the big providers your customers use, got strict. Now, before they will trust a message, they want proof that it genuinely came from the business it claims to be from.

SPF, DKIM and DMARC are how a domain provides that proof. When they are set correctly, your mail arrives with a clean bill of health and drops into the inbox. When they are missing, incomplete, or contradict each other, the receiving server cannot verify you, shrugs, and files your message in spam or refuses it entirely. Your email is not being punished for what it says. It is being doubted for who it says it is from.

The three records, in plain words

Think of getting an email delivered like getting a parcel past a careful security desk. Three things get you waved through:

• SPF is the permit. It is a list, published on your domain, of which mail servers are allowed to send email as your business. When a message arrives, the receiver checks: did this come from a server on the permitted list? If yes, good. If it came from somewhere not on the list, that is a red flag.
• DKIM is the tamper-proof signature. It adds a hidden, cryptographic signature to every message you send. The receiver checks the signature and learns two things: that the message really came from your domain, and that nobody altered it on the way. A valid signature is hard proof of authenticity.
• DMARC is the rulebook. It ties SPF and DKIM together and tells receivers what to do when a message fails the checks: let it through, send it to spam, or reject it. It also sends you reports on who is sending mail as your domain, which is how you catch both misconfiguration and impersonation.

A permit, a signature, and a rulebook. Individually helpful. Together, they are what a modern mail system needs to trust you.

You need all three, in the right order

The most common half-fix I see is a business that set up SPF years ago and stopped, and cannot understand why mail still lands in spam. SPF alone is no longer enough. DKIM alone leaves gaps. And DMARC does nothing on its own, because it depends on the other two being in place first. Reliable delivery needs all three working together and agreeing with each other.

Order matters, too, and this is where a rushed attempt can backfire. Get SPF and DKIM correct first and confirm they are passing. Only then introduce DMARC, gently, watching its reports, before tightening its rule. A strict DMARC policy switched on before SPF and DKIM are solid can reject your own legitimate email, which is a worse problem than the one you started with. Done in sequence it is safe and transformative. Done as a hopeful guess, it can silence your own outbox.

Why it can go wrong all of a sudden

A frequent, baffling version of this is email that worked fine for years and then suddenly starts bouncing or landing in spam. Nothing changed at your end, so why now? Because the receivers keep raising their standards. Mail that scraped through under the old rules gets caught the moment a big provider tightens its threshold, and they do that regularly. A new email service, a marketing or booking tool sending messages on your behalf, or simply the industry moving on can all be the trigger.

The cause is different but the cure is the same: get SPF, DKIM and DMARC properly aligned so your mail passes the stricter checks it now faces. If your mail is already being outright rejected or blacklisted, that is the acute end of the same problem, and it is worth treating with some urgency because every bounced message is a lost conversation.

What this quietly costs, and why it is worth fixing

The insidious thing about email deliverability is that it fails silently. Nobody tells you your quote went to their junk folder. The client simply goes with whoever replied, and you never learn you were in the running. A business can lose work for months to a spam-folder problem it does not even know it has. That is what makes this worth a proper look even when nothing seems obviously broken.

Email sits alongside your other business foundations, and it deserves the same care. If you are tightening up how your business runs online, it pairs naturally with getting your backups right and your cyber security in order, because authenticated email is as much a security measure as a delivery one: the same records that get your mail into inboxes also make it far harder for a scammer to impersonate your business to your own customers.

FAQ

Why does my business email keep going to spam?

Usually because the receiving mail systems cannot confirm your email genuinely came from you. Three records, SPF, DKIM and DMARC, are how a domain proves that. If they are missing, wrong, or incomplete, mail servers treat your message as suspicious and file it in spam or block it outright. Getting all three set correctly is what moves your mail back to the inbox.

What are SPF, DKIM and DMARC in plain English?

They are three settings on your domain that together prove your email is really you. SPF lists which servers are allowed to send email as your business. DKIM adds a tamper-proof signature to each message. DMARC ties the two together and tells receivers what to do if a message fails the checks. Think of them as a permit, a signature, and a rulebook.

Which one do I need? Do I need all three?

You need all three working together for reliable delivery. SPF alone helps but is not enough, and DKIM alone leaves gaps. DMARC only works once SPF and DKIM are in place, because it depends on them. Setting up one or two and stopping is the common half-measure that leaves mail still landing in spam. The three are a set.

My email suddenly started bouncing or getting blocked. Why now?

Receivers have steadily tightened their rules, and mail that squeaked through for years can suddenly be rejected once a threshold changes. A new email service, a marketing tool sending on your behalf, or simply a big provider raising its standards can be the trigger. The fix is the same: get SPF, DKIM and DMARC properly aligned so your mail passes the stricter checks.

Can setting these up wrong make things worse?

Yes, which is why care matters. A too-strict DMARC rule set before SPF and DKIM are fully correct can cause your own legitimate email to be rejected. The safe approach is to get SPF and DKIM right first, watch the reports, then tighten DMARC gradually. Done in the right order it is safe; done as a rushed guess it can block your own mail.

Can Alien IT fix our email deliverability?

Yes, it is one of the most common things we sort for businesses. We check what is set on your domain, fix the SPF, DKIM and DMARC records so your mail is properly authenticated, and confirm delivery improves. If your business email is landing in spam or bouncing, that is a fixable problem, and it is worth fixing because it quietly costs you replies you never knew were missed.

The bottom line

If your business email lands in spam or bounces, it is almost never your writing and almost always your authentication. SPF proves which servers may send as you, DKIM signs each message so it cannot be faked or altered, and DMARC ties them together and tells receivers how to judge the rest. Set all three, in the right order, and your mail goes from doubted stranger to trusted sender. Leave them half-done, and you keep losing conversations you never even see.

Email landing in spam, bouncing, or blacklisted? We will check what is set, fix the records properly, and get your mail back in the inbox. Tell us what is happening with your email and we will sort it, no jargon.