Why Are My Emails Going to Spam? A Small Business Diagnosis

A customer says your quote never arrived. It turns out it did: it's sitting in their spam folder, next to the fake parcel notices. It happens again with an invoice, then with a reply to an enquiry, and now you're wondering how many you never heard about.

The instinct is to blame the wording. Usually that's not it. Gmail, Outlook and the other big inboxes decide where a message goes mostly on whether they can prove it came from you, and then on the sending domain's track record. The words in the email come a distant third.

Here's how to work out which part is failing, in the order worth checking.

First, find out who it's happening to

Before changing anything, narrow it down. The answers point at different causes.

• Is it every recipient, or one company? If it's only one customer's office, their own email filter may be strict, and the fix may be on their side (asking them to mark you as safe). If it's Gmail and Outlook users across the board, it's your setup.
• Is it every email, or one kind? If normal replies arrive but your website's contact form notifications or your newsletter don't, the problem is the system sending those, not your mailbox.
• Did it start suddenly? A sudden change usually follows something specific: a move to a new email provider, a new website, a new booking or invoicing tool that sends in your name, or a DNS change.

Send a test email to a personal Gmail or Outlook.com address you control. If it lands in spam there, open it and look at the message details ("Show original" in Gmail). You'll see lines for SPF, DKIM and DMARC, each marked PASS or FAIL. That one screen often tells you exactly which of the next sections to read.

Cause 1: SPF is missing or broken

SPF is a DNS record that lists the services allowed to send email for your domain. If an email arrives from a server that isn't on the list, the receiving inbox treats it as suspicious.

It goes wrong in a few predictable ways:

• There's no SPF record at all. Common on domains that have been set up once and never touched.
• There are two SPF records. Each new service you sign up for tells you to "add this SPF record", and someone adds a second one instead of merging it into the first. Two SPF records is an error, and inboxes treat the result as a fail.
• A service you use isn't included. You moved to Microsoft 365 but the record still only lists your old host, or you started sending invoices from an accounting tool that was never added.
• Too many lookups. SPF allows a maximum of 10 DNS lookups. Every include: for a new service adds at least one, and going over means SPF fails.

This is not a rare problem. In our October 2026 audit of 359 South West small business websites, 23% had no SPF record or more than one.

Our free SPF checker reads your record, counts the lookups and flags a second record. If you use Google Workspace, our guide to the SPF record for Google Workspace has the exact line to use.

Cause 2: DKIM isn't switched on

DKIM adds a digital signature to every email you send, using a key published in your DNS. The receiving inbox checks the signature against the key. If it matches, the email provably came from your domain and wasn't altered on the way.

Most email providers support DKIM, but many don't switch it on for you. Google Workspace and Microsoft 365 both need you to generate a key in the admin console and add a DNS record before signing starts. Until you do, your emails go out unsigned, or signed with the provider's own domain rather than yours, which does nothing for your domain's reputation.

The same applies to every other service that sends as you. Your newsletter tool, booking system or CRM will each have its own DKIM setup in its settings, usually labelled "domain authentication" or "verify your sending domain".

Checking DKIM from outside is harder than SPF, because each service publishes its key under its own name (the "selector"), and there's no way to list them all. Our DMARC and email security checker tries the common selectors used by Google, Microsoft, Mailchimp and other popular providers. If it finds a key, DKIM is set up for that provider. If it doesn't, check your provider's admin console, which will tell you directly.

Cause 3: there's no DMARC record

DMARC ties SPF and DKIM together. It tells inboxes what to do when an email claiming to be from you fails both checks, and it asks them to send you reports on who is sending in your name.

Since February 2024, Google and Yahoo have required DMARC from anyone sending large volumes to their users, and Microsoft brought in similar rules for Outlook.com in 2025. Those rules are aimed at bulk senders, but the direction is clear: inboxes increasingly expect a DMARC record from any business domain, and a domain without one looks less trustworthy than one with it.

Half the sites in our October audit (50% of 359) had no DMARC record at all.

A starting record is one line of DNS:

_dmarc.yourdomain.co.uk  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk"

p=none changes nothing about delivery yet; it just switches on reporting so you can see what's sending as you before tightening the policy. Our explainer on SPF, DKIM and DMARC covers the order to set them up and when to move to quarantine or reject. The DMARC checker grades what you have now and gives you a corrected record to paste in.

Cause 4: your website is sending email "as you"

This one catches a lot of small businesses, and it's the reason contact form notifications so often vanish.

When someone fills in the form on your website, the site sends you an email. Many website setups, especially WordPress on shared hosting, send that email straight from the web server, with your own address in the From line. But the web server isn't listed in your SPF record and can't sign with your DKIM key. To Gmail or Outlook, it looks exactly like someone forging your address, and it goes to spam or disappears.

The fix is to make the website send through a proper email service rather than the server's built-in mail. On WordPress that's an SMTP plugin connected to your Google Workspace or Microsoft 365 account, or to a transactional email service, which you then add to your SPF record and set up DKIM for. On hosted builders such as Wix or Squarespace this is handled for you, and form notifications usually come from the platform's own address instead of yours.

The same applies to any tool that sends invoices, booking confirmations or receipts with your address in the From line. Each one either needs adding to SPF and DKIM, or should send from its own address with yours as the Reply-To.

Cause 5: your domain or server has a poor reputation

If SPF, DKIM and DMARC all pass and emails still land in spam, look at reputation.

• Blocklists. If your domain or your email server's IP address appears on a public blocklist, some inboxes will reject or junk your mail. Free lookup tools check the major lists in one go. On shared hosting, another customer on the same server can get its IP listed, which is another reason to send through a dedicated email provider.
• A new domain. A domain that has only just started sending has no track record. Inboxes are cautious until it builds one. Sending steadily to people who expect to hear from you is the cure; a sudden blast of hundreds of emails from a new domain is the fastest way to the spam folder.
• Complaints. If people mark your emails as spam, inboxes notice. This mostly affects newsletters: send only to people who opted in, and make unsubscribing a single click.

Google's free Postmaster Tools shows how Gmail sees your domain's reputation and spam rate, once you're sending enough volume for it to report on.

Cause 6: what's in the email

Content matters less than people think, but it can tip a borderline email over the line.

• Links that don't match your domain, especially link shorteners, or a link whose text shows one address and points to another.
• One large image with little text, which is how a lot of spam is built.
• Attachments of unusual types, or large ones. Linking to a document is safer than attaching it.
• A From name and address that don't match, or a Reply-To on a completely different domain.

Words like "free" or "offer" on their own won't send a legitimate, properly authenticated email to spam. Don't spend time rewording until the earlier causes are ruled out.

The order to fix things

1. Run your domain through the DMARC and email security checker and the SPF checker. They read your public DNS records and don't send any email.
2. Fix SPF so there's one record that includes every service that sends as you.
3. Switch on DKIM in your email provider and in each other sending tool.
4. Add a DMARC record at p=none and read the reports for a few weeks.
5. Move your website's forms off the server's built-in mail.
6. Only then look at blocklists, reputation and content.

Most small businesses that work through the first four steps see the problem stop. If spoofing is part of what worries you, the website security audit guide covers the rest of the checklist beyond email.