Blog · Email
Why business mail lands in spam, and the DNS records that stop it
By the Hosting & Domains team Published 27 July 2026 7 min read
Few sentences sting like a customer saying they found it in their spam folder. The invoice, the quote, the proposal you spent the evening on, filed in among the pills and the princes. When a small business sends from its own name, the wording of the message is almost never the problem. The problem is authentication: your domain is offering no cryptographic proof that the mail came from you.
Since Google and Yahoo tightened their bulk-sender rules in 2024, and they have only tightened further since, unauthenticated mail no longer gets the benefit of the doubt. The consolation is that fixing it means three DNS records, all free, and the whole job fits inside twenty minutes.
The three records, translated
SPF is the approved-sender list. It is a DNS record naming every server allowed to send mail for your domain. Receiving servers check the sending IP against that list and fail anything outside it. It is one record on one line, and the SPF walkthrough writes it with you.
DKIM is the tamper-proof signature. Each outgoing message is signed by your mail server with a private key, while the matching public key sits in DNS for receivers to check against. Where the signature checks out, the message is genuine and reached them unaltered. Turning it on is one panel toggle plus one record.
DMARC is the standing instruction. It tells receivers what to do with mail that fails SPF and DKIM, whether to deliver anyway, quarantine or reject, and where the reports should go. Gmail now all but requires one from any domain hoping for the inbox. Start on p=none and read the reports, then tighten the policy once they come back clean.
Why mail still fails once the records are in
Application mail going out through the wrong door. A contact form in WordPress, or an invoicing app, sends "from" your domain through a server your SPF record has never heard of, so all of those messages fail. Send application mail over authenticated SMTP instead; in WordPress that is a ten-minute job.
A duplicate SPF record. A domain may have exactly one. A second, usually left behind by an old provider, breaks SPF completely. Merge the two into a single record.
Sending as your own domain out of personal webmail. A personal Gmail account's "send as" setting for you@yourdomain, used without genuine SMTP authentication, fails DMARC at every strict receiver. Mail for your domain belongs on your domain's own mail service.
And one cause DNS cannot address: history. A domain that jumps from silence to hundreds of identical messages looks exactly like a hijacked mailbox. Bring new domains up gently, and keep invoices and receipts well apart, in volume, from any marketing send.
Twenty minutes, five steps
One, list everything that legitimately sends as your domain: the mailbox, the website forms, the invoicing tool. Two, put out one SPF record that covers precisely those senders. Three, turn DKIM signing on at your mail host and publish the key. Four, publish DMARC at p=none with a reporting address, leave it a week, read what comes back, then move up to quarantine. Five, send to a Gmail address and open Show original. Three green PASS lines is the finish.
On our email hosting the SPF and DKIM records are generated for every mailbox domain and the panel states exactly what to publish, which turns most of those twenty minutes into reading. Inbound spam filtering is in every plan, and a domain needing more can put dedicated mail filtering in front of any mailbox, hosted anywhere.
Quick answers
Why does my business mail land in spam when it is not spam?
Almost always because authentication is missing. Without SPF, DKIM and DMARC a receiver cannot confirm the mail really left your domain, and under the 2024 Gmail and Yahoo rules unverified mail is downgraded by default. The content matters far less than senders imagine.
SPF, DKIM and DMARC — what is each one for?
SPF publishes the list of servers cleared to send mail for your domain. DKIM stamps each message with a signature showing it is genuine and untouched. DMARC tells receivers what to do with failures and reports back to you. Between them they settle inbox or junk.
How soon does deliverability recover once the records exist?
The authentication works as soon as DNS propagates, which is hours. Reputation takes longer to rebuild: expect steady gains over two to four weeks of consistent, authenticated sending.
Up next
Email Hosting
Mailboxes on your own name, SPF and DKIM prepared for you, spam filtering in the price.
Stop Email Going to Spam (Tutorial)
The practical version, with every record written out in full.
Mail Filtering
Inbound and outbound filtering set in front of any mailbox.
More from the blog
What web hosting really costs in 2026
The opening rate is the lure; the renewal rate is what you have really bought. Here is the three-year arithmetic, done in the open.
“Unlimited” web hosting: where the ceilings are really kept
Hardware runs out. 'Unlimited' means capped in units nobody has ever counted: inodes, CPU seconds and a fair-use clause.
A free domain with hosting: four things to check before you claim one
The first year really does cost nothing. The second year is where the reading begins: the renewal price, the registrant, and the terms for leaving.
The platform these posts come from
Renewals that stay flat, limits printed before you buy, migration at no charge and a support desk that writes back, all wrapped into one plan.
Browse Hosting Plans