Why does good business email land in spam?
When your quote replies, order confirmations or website form notifications go to spam, the cause is usually not the wording. It is that receiving servers cannot confirm the message really came from your domain, and three DNS records, SPF, DKIM and DMARC, are how they check.
Anyone can type your address into the From line, so Gmail, Outlook and Yahoo look up those records: SPF lists the servers allowed to send for your domain, DKIM adds a signature that proves the message was not altered, and DMARC tells receivers what to do when those checks fail. Mail without them is treated as suspect, and since 2024 Gmail and Yahoo have required at least some of them from every sender.
Setting up SPF, DKIM and DMARC takes an hour or two for a typical small business and costs nothing beyond access to your DNS. The sections below go through each record, sample values, and the mistakes that break them.
Other things also hurt delivery, such as sending from a new domain in large volumes, a shared server with a poor reputation, or content that looks like phishing. A compromised site that sends spam from your server can drag your domain down too, which our guide on fixing a hacked WordPress site deals with. Authentication is still the first fix, because without it nothing else counts.
SPF: who may send for your domain
SPF is a TXT record on your domain that lists the services allowed to send mail using it. A domain that sends only through Google Workspace would publish:
v=spf1 include:_spf.google.com ~all
Each include adds a provider's servers. The ending decides what happens to everyone else: ~all is a soft fail (treat with suspicion), -all a hard fail (reject). Many providers recommend ~all while you are still finding every sender, then tightening once DMARC reports confirm the list is complete.
Three rules people break
- One SPF record only. If your domain has two TXT records starting with v=spf1, receivers treat SPF as broken. Merge them into one line with several includes.
- Ten DNS lookups at most. The SPF standard, RFC 7208, limits a check to ten DNS lookups. Every include counts, and includes inside includes count too. Stacking a mail provider, a newsletter tool, a CRM and a helpdesk can go over, and SPF then fails for everyone.
- List every sender. Your web server, a newsletter service and an invoicing tool may all send as your domain. Each one needs to be covered by SPF or, better, sign with DKIM.
DKIM: a signature on every message
DKIM signs each outgoing message with a private key held by your email provider. The matching public key sits in your DNS, and the receiver uses it to check that the message came from an authorised system and was not changed on the way.
You do not write DKIM keys yourself. Your provider generates them and shows you what to publish:
- Google Workspace: generate the key in the Admin console under Gmail authentication, add a TXT record at a name such as google._domainkey, then press Start authentication.
- Microsoft 365: publish two CNAME records, selector1._domainkey and selector2._domainkey, pointing to the values shown in the Defender portal, then enable DKIM signing for the domain.
The part before ._domainkey is the selector. It lets one domain hold several keys, so your mailbox provider, your newsletter tool and your transactional service can each sign with their own. Use 2048-bit keys where the provider offers them, and never delete an old selector until nothing is still signing with it.
DMARC: the policy that ties them together
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do when a message claiming to be from you fails both SPF and DKIM alignment, and where to send reports. A safe first record:
v=DMARC1; p=none; rua=mailto: followed by a reports mailbox on your own domain.
Policies, in order
- p=none changes nothing about delivery; it just turns on reporting. Start here.
- p=quarantine asks receivers to send failing mail to spam.
- p=reject asks them to refuse it, which is the strongest protection against people spoofing your domain.
Alignment and reports
DMARC passes only when SPF or DKIM passes and the domain it checked matches the domain in the visible From address. That is why a newsletter tool that signs with its own domain can pass DKIM yet still fail DMARC. The daily aggregate reports, XML files sent to the rua address, show every service sending as you. Read them for a few weeks, fix the unknown senders, then move to quarantine and later reject.
Which records does a typical small business need?
For a Bangkok company on Google Workspace or Microsoft 365 with a WordPress site, set things up in this order. If you are still deciding between Google Workspace and email from your hosting account, settle that first, since the records depend on it. You add the records wherever your DNS is managed: usually the domain registrar, your host's control panel, or Cloudflare if your nameservers point there. Changes normally take effect within minutes to a few hours, but can take up to the record's TTL or longer to reach every resolver.
- 1. Find where DNS livesLook up your nameservers; edit records only there, or changes do nothing.
- 2. SPFGoogle: v=spf1 include:_spf.google.com ~all. Microsoft 365: v=spf1 include:spf.protection.outlook.com -all. Add other senders to the same single record.
- 3. DKIMPublish the key or CNAMEs your provider generates, then switch signing on in its admin screen.
- 4. DMARCv=DMARC1; p=none; rua=mailto: an address you read.
- 5. Website mailPoint the site at an authenticated SMTP or transactional service that signs with DKIM for your domain.
- 6. Review and tightenAfter a few weeks of clean reports, move DMARC to quarantine, then reject.
Website and WordPress form emails
Form notifications are where many small businesses lose enquiries without noticing. By default WordPress sends mail through the web server's PHP mail function. The server is rarely listed in your SPF record, it does not sign with your DKIM key, and on shared hosting it may share an IP with many other sites. The result is a quote request that quietly lands in spam, or never arrives.
The fix
- Send through a real mail service. Use an SMTP plugin connected to your Google Workspace or Microsoft 365 account, or to a transactional email service that signs with DKIM for your domain.
- Use your own From address. Send from a mailbox on your own domain, such as a dedicated website sender address, never from the visitor's address. A form that sends "from" the visitor's Gmail is spoofing Gmail, and it will fail DMARC.
- Put the visitor in Reply-To. Your team can still press reply and answer the customer directly.
- Keep a copy. Store submissions in the site as well, so a lost email is not a lost lead. Under PDPA, keep only what you need and delete old entries on a schedule.
Which host your site sits on changes the details, but not the principle; our guide to hosting in Thailand covers what else to look for.
Gmail and Yahoo sender rules
From February 2024, Google and Yahoo tightened what they accept. The rules, set out in Google's email sender guidelines and Yahoo's sender best practices, fall into two tiers.
Everyone who sends to Gmail or Yahoo
- Set up SPF or DKIM for your sending domain.
- Have valid forward and reverse DNS for sending servers, and send over TLS.
- Keep reported spam rates low.
Bulk senders
Google defines bulk senders as those sending more than 5,000 messages a day to Gmail accounts. They must also have SPF and DKIM both, a DMARC record of at least p=none, alignment between the From domain and SPF or DKIM, and one-click unsubscribe in marketing mail.
Most small businesses are not bulk senders, but a promotion to a large customer list can cross the line. Setting up all three records now means you meet both tiers without thinking about it.
Testing and monitoring
Do not assume it works; check.
- Read the headers. Send a message to a Gmail address, open it, choose Show original, and look for SPF, DKIM and DMARC each marked PASS.
- Use a checker. Free online tools look up your SPF, DKIM and DMARC records and flag syntax errors, duplicate SPF records and lookup counts.
- Submit your own form. Fill in the website's contact and quote forms and confirm the emails arrive in the inbox, not spam.
- Read DMARC reports. A report service turns the XML files into something readable.
Re-check after any DNS change, including a move of the kind discussed in our article on whether server location affects SEO. Checking email records belongs on a website maintenance checklist, and our explainer on what website maintenance covers shows where it fits. If you would rather hand it over, our website maintenance services can include checking form delivery after updates; see how website maintenance cost is quoted per site.
Keep reading
Sources
- RFC 7208: Sender Policy Framework (SPF)
- RFC 6376: DomainKeys Identified Mail (DKIM)
- RFC 7489: DMARC
- Google Workspace Admin Help: email sender guidelines
- Yahoo Sender Hub: best practices
- Microsoft Learn: set up SPF for Microsoft 365
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us