If your quotes are not arriving, your invoices are being ignored and people keep saying they never got your email, the problem is almost certainly not your mailbox provider. It is three DNS records, and most small businesses have none of them set up properly.

Why spam filters distrust you by default

Email was designed in an era when nobody expected anyone to lie. Anyone can send a message claiming to be from your domain, and nothing in the original design stops them.

So receiving mail servers got suspicious. They now check whether the server sending your email is actually allowed to. If your domain gives no clear answer, your message is treated as questionable, and questionable mail goes to spam or gets silently dropped.

Three records give that answer.

SPF, the list of who may send

SPF is a single line in your DNS naming every service permitted to send email on your behalf. Your mail provider, and anything else that sends as you: your accounting software, your booking system, your website contact form, your newsletter tool.

Two things go wrong with it constantly.

Something legitimate is missing. You added invoicing software two years ago and nobody updated SPF, so every invoice it sends looks forged.

There are two SPF records. Somebody added a second rather than editing the first. The specification allows exactly one, and when a server finds two it treats the check as broken, which is worse than having none at all.

DKIM, the signature

DKIM signs each message cryptographically. The receiving server checks the signature against a key published in your DNS. If it matches, the message genuinely came from you and nothing was altered in transit.

Most providers can turn this on in a few clicks and then require a DNS record adding. The clicking gets done and the DNS record does not, which leaves DKIM half configured and doing nothing.

DMARC, the instruction

DMARC ties the other two together and tells receiving servers what to do when a message fails: let it through, put it in spam, or reject it outright. It can also send you reports about who is sending mail claiming to be you, which is how people discover somebody is impersonating their domain.

Set it to monitoring first. Going straight to reject before you know what legitimately sends as you is how businesses accidentally block their own invoices.

Why this got urgent

Google and Yahoo both tightened their requirements for bulk senders, and the practical effect has spread well beyond bulk. Domains without proper authentication are treated with noticeably more suspicion than they were a few years ago. If your deliverability quietly got worse and nothing on your side changed, that is why.

How to check in five minutes

Send an email from your business address to a Gmail account you control. Open it in a browser, click the three dots and choose Show original.

You will see SPF, DKIM and DMARC each marked PASS or FAIL. Three passes and your authentication is fine, so a delivery problem is something else. Any fail, and you have found it.

What it is worth

One quote landing in spam costs more than getting this fixed. A supplier invoice paid to a spoofed bank account costs a great deal more, and DMARC is the record that makes impersonating your domain difficult.

It is usually an hour of work. Sometimes two if the DNS has been edited by several people over several years, which is common.

If you run the Gmail check and see a FAIL, send me the result and I will tell you what is missing. I set all three up as standard on business email accounts, and I will happily fix them on email hosted somewhere else.