You send a quote to a new customer, they never reply, and you assume they went with someone else. In reality your email may have dropped straight into their spam folder, and you never knew. For small local businesses, that quiet failure costs real jobs. The usual culprit is not your wording: it is three small DNS records that prove your mail is genuinely from you. This guide explains SPF, DKIM, and DMARC in plain English, why a missing or wrong record sends invoices and quotes to junk, and the exact order to check them. The rules and thresholds below are current as of November 2026.
Why good email lands in spam
Mail providers like Gmail, Yahoo, and Outlook are flooded with scams that forge the sender name. To fight back, they now trust a message far more when the sending domain can cryptographically prove the mail is really authorized by that domain. If your domain cannot prove it, your message looks suspicious even when the content is perfectly honest. That is why a plain, truthful invoice can still be filtered: the problem is identity, not intent.
This matters more than ever. Since February 2024, Gmail and Yahoo have required bulk senders (those sending roughly 5,000 or more messages a day) to use all three records, and through late 2025 the providers tightened enforcement from quiet delays toward outright rejection. Even small senders feel the ripple, because the same trust signals decide whether your ordinary business mail is believed.
The three records, in plain English
Think of the three records as three different ways your domain vouches for a message.
| Record | What it does | Plain-English version |
|---|---|---|
| SPF | Lists which mail servers are allowed to send for your domain | “These are the mail trucks allowed to deliver in my name.” |
| DKIM | Adds a tamper-proof digital signature to each message | “This letter carries my sealed signature and was not altered.” |
| DMARC | Tells receivers what to do if SPF or DKIM fails, and sends you reports | “If a message fails the checks, here is how to handle it, and tell me about it.” |
SPF and DKIM do the proving. DMARC sets the policy and gives you visibility. All three live as text records in your domain’s DNS settings, the same place your website address is managed.
How one missing record sends mail to junk
Here is the common trap. A business signs up for a new tool, a booking system, a newsletter service, or an accounting app, and starts sending mail “from” its own domain through that tool. But the domain’s SPF record never listed the new service, and DKIM signing was never switched on there. Now the mail is going out under your name from a server your domain never authorized. Receivers see the mismatch, and your quotes and invoices start quietly failing. The fix is almost always to add the new service to your records, not to rewrite your emails.
The exact order to check them
When mail is going to spam, resist the urge to change five things at once. Work through them in order, because each record builds on the last.
- Confirm the problem. Send a test message to a Gmail, Yahoo, and Outlook address and see where it lands.
- Check SPF first. Make sure a single SPF record exists and lists every service that sends mail for you (your mailbox provider, website, booking tool, newsletter platform). Two separate SPF records will break it, so they must be combined into one.
- Check DKIM next. Turn on DKIM in each sending service and publish the key it gives you. Confirm the mail is actually being signed, not just configured.
- Add DMARC last. Start with a gentle policy (known as p=none) so nothing is blocked while you watch the reports, then tighten it once everything passes.
- Re-test and give it time. DNS changes can take a few hours to take effect, so re-send your test the next day before judging the result.
Use a free email authentication checker to see each record’s status in seconds rather than guessing. If the output reads like a foreign language, that is normal, and it is a fair point to hand the task to a professional.
What about one-click unsubscribe and spam complaints?
If you send any kind of newsletter or marketing email, two more rules now apply alongside the three records. Bulk messages must include a working one-click unsubscribe link in the header so recipients can leave in a single tap, and your spam-complaint rate must stay below 0.3 percent. In practice that means mailing only people who asked to hear from you, making it easy to leave, and never buying lists. Good list habits protect the sender reputation that keeps all your mail, even your one-to-one quotes, out of the junk folder.
Getting it set up without the headache
Email authentication is a one-time setup that pays off every day afterward, but it touches DNS, which is easy to get wrong and nerve-wracking to experiment with on a live domain. If you want it done right the first time, it pairs naturally with getting business email on your own domain set up correctly from the start. Our team configures SPF, DKIM, and DMARC as part of website and email services so your invoices actually reach inboxes.
Frequently asked questions
Do I need all three records, or just one?
You want all three working together. SPF and DKIM each prove authenticity in a different way, and DMARC ties them together and tells receivers what to do when a check fails. Leaving one out weakens the whole chain and is a common reason mail still lands in spam.
Will fixing these records stop every email from going to spam?
It removes the biggest technical reason mail is filtered, but content and reputation still matter. Spammy wording, broken links, or a history of complaints can still hurt you. The records give honest mail its best possible chance to be delivered.
I use Gmail or Microsoft 365 for my business email. Am I already covered?
Partly. Those providers make SPF and DKIM easy to enable, but you still have to turn DKIM on and publish a DMARC record yourself, and you must add any other tool that sends in your name. Do not assume it is automatic.
How long after changing a record will I see a difference?
DNS changes usually take effect within a few hours, though they can take up to a day to spread everywhere. Send a fresh test the following day rather than judging the result minutes after you save.
What is a DMARC report and do I have to read it?
A DMARC report is a summary receivers send back showing which messages passed or failed the checks. You do not have to read the raw files; many tools turn them into a simple dashboard that flags any service sending mail in your name that you have not authorized.
If your quotes and invoices keep going unanswered, it may not be your customers ignoring you. Get started here and we will check your records and get your email landing where it belongs.