Keep your business email out of spam

You send a quote and the client finds it three days later in spam. If you open that message in Gmail with «Show original», you'll probably see something like this:

SPF:   FAIL
DKIM:  'NONE'
DMARC: FAIL

Gmail couldn't verify that the email really came from your company, so it treated it as suspicious. Those three lines are three DNS records, and all three can be fixed.

SPF: who can send on your behalf

yourcompany.com.  TXT  "v=spf1 a mx include:_spf.newsletter-platform.com ~all"

This record is the list of servers allowed to send email using your domain. a and mx authorize your own server; each include adds an external service, like your newsletter platform or invoicing system; the final ~all marks anything else as suspicious.

One detail that breaks a lot of domains: there can only be one SPF record. If someone added a second one when signing up for another service, both become invalid. They need to be merged into one.

DKIM: a signature that proves nobody tampered with the message

DKIM-Signature: v=1; a=rsa-sha256; d=yourcompany.com; s=default;
  bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=; b=...

That header travels inside every signed email. The receiving server looks up the public key at default._domainkey.yourcompany.com and checks the signature. If the signature matches, it knows the message came from your server and wasn't modified along the way. Most hosting panels let you enable it with one click.

DMARC: what to do with emails that fail the test

_dmarc.yourcompany.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com"

This record tells Gmail, Outlook and the rest what to do when an email claims to come from your domain but fails SPF and DKIM. The key part is p=, and it's best to move in stages:

p=none: you only observe. You get reports on who sends email using your domain.
p=quarantine: suspicious emails go to spam.
p=reject: they're rejected. This level best protects your brand against impersonation.

Don't jump straight to p=reject. Leave DMARC in monitoring mode for two or three weeks and read the reports: it's common to find a system sending email on your behalf that nobody remembered, like e-invoicing or a website form.

Since 2024, Gmail and Yahoo require authentication from high-volume senders, and in practice a domain without these three records is far more likely to end up in spam, even if it sends only a few messages.

Habits that also matter

Don't send newsletters from your personal mailbox. Use a bulk email platform set up with your domain.
Keep your list clean: remove addresses that bounce and never buy databases.
Avoid alarmist subject lines, excessive capitals and emails that are a single image.
Include a real signature with name, company and contact details.
Protect your passwords: a compromised account sending spam can damage the reputation of your whole domain.

Do this today

Send an email to a Gmail account and check «Show original».
If SPF fails, list every service that sends on your behalf and merge them into a single record.
Enable DKIM in your hosting panel.
Publish DMARC with p=none and read the reports before tightening it.

Once all three show PASS, you've removed the most common cause of email landing in spam.

eXpertweb's shared hosting plans include business email on your own domain. If your emails are ending up in spam, we can review your records and set them up for you.

Back