When your company email lands in spam: SPF, DKIM and DMARC

Will changing the email text stop it going to spam?

When corporate email lands in spam the first reflex is to change the wording: fewer capitals, drop the word "free", reduce the links. That occasionally makes a small difference, but the decision is taken earlier than that. The receiving server first asks: does this message really come from this domain?

The answer to that question lives in DNS, not in the text. With no answer, the message is treated as an unauthenticated sender however clean its content is — and most corporate recipients put those messages either in spam or straight in the bin.

What are SPF, DKIM and DMARC and how do they differ?

The three have to work together. A company with only SPF loses authentication whenever a message is forwarded. One with only DKIM never learns who is sending in its name. And a setup without DMARC is defenceless against spoofing in your name — which is the most common shape invoice fraud takes.

What does Gmail require from bulk senders?

Google raised the bar with sender requirements that took effect in February 2024. Everyone sending to personal Gmail accounts is expected to have SPF or DKIM, valid forward and reverse DNS records, transmission over TLS, and a spam complaint rate below 0.3%.

For anyone sending more than 5,000 messages a day the bar rises: both SPF and DKIM, plus DMARC (the policy may be `p=none`), alignment between the domain in the From: header and either the SPF or DKIM domain, and one-click unsubscribe on marketing messages. A company crossing that threshold with incomplete records can lose its delivery overnight.

What are the most common SPF record mistakes?

• Two SPF records on the same domain — the record is treated as invalid and authentication fails.
• Exceeding the lookup limit while adding a new sending source; as the chain grows the record quietly stops working.
• Starting DMARC straight at `p=reject` and silencing legitimate sources nobody knew about.
• Publishing DMARC without a reporting address — which means never collecting the data needed to tighten the policy.
• Forgetting subdomains: if mail goes out through `invoices.company.com`, that host needs its own records.

Why do invoice emails not reach customers?

Two points stand out. First, e-invoice and bookkeeping integrators: these can send notifications from your domain and are the item most often missed in the inventory. When an e-invoice notification does not reach a customer, the problem is usually not the integrator but that the integrator is absent from your SPF list.

Second, the bulk messaging side: if you send commercial electronic messages, the national message-management obligations are separate from technical delivery but affect the same sending. The unsubscribe link has to work in one click technically and be processed in the system as a record; tracked separately or not at all, the complaint rate climbs and delivery degrades even with correct records.

How long does SPF, DKIM and DMARC setup take?

Writing the records is an hour's work; DNS propagation takes a few hours. What lengthens the job is the listening phase: tightening the policy without reading DMARC reports for at least two weeks risks cutting off legitimate mail. A realistic schedule is setup on day one, two to four weeks of observation, then tightening in stages.

Can I send email from a brand-new domain?

You can, but do not send in bulk immediately. Thousands of messages leaving a new domain at once reads as suspicious even with correct records. What works is warming up: a few dozen a day in the first week, rising gradually. A hasty first bulk send can damage a domain's reputation in a way that takes months to repair.

Is sending business email from personal Gmail a problem?

Not for deliverability, but for trust yes. A quote arriving from a free address does not read as a corporate counterpart, and corporate filters treat attachments from unknown free addresses more strictly. Correspondence sent from a personal address also does not sit in the company archive; when that person leaves, the history goes with them.

Should I use a separate domain for bulk email?

If marketing volume is significant, yes — but as a subdomain. When the main domain carrying invoices and quotes is separated from the subdomain carrying the newsletter, a newsletter complaint does not damage the main domain's reputation. In companies that do not separate them, one bad campaign sends invoice notifications to spam too.

Who is going to read the DMARC reports?

The raw reports are XML and not made to be read by hand; using a report processing service is close to mandatory. Free tiers suffice at low volume. An unread report is the same as no record: if nobody sees the data needed to tighten the policy, `p=none` becomes permanent and offers no protection against spoofing.

Does an image in the signature cause spam?

Not on its own, but it contributes. Heavy graphics, many outbound links and signatures made only of an image lose points with filters. The practical measure: the signature has to be readable as text, and no information should be lost when images do not load. That is an accessibility requirement too.

“A spam problem is almost never in the text; the receiving server checks identity before it reads a word.”