Why do my business emails go to spam?

Nobody writes to tell you their copy of your invoice went to junk. They just don't pay it, and three weeks later there's an awkward phone call. That silence is the whole problem: the failure is invisible to the one person who could fix it.

So it's worth being precise about what's actually going wrong. Spam filtering used to be about the message — its words, its links, its attachments. That's now the second question. The first is whether the receiving server can prove the message came from where it claims.

The six reasons this usually happens

In practice, almost every case of small-business mail landing in junk traces back to one of these.

You have no SPF or DKIM at all

The baseline requirement since February 2024. Without at least one of them, you fail at the door — no reputation, no history, no second look.

A tool that sends as you isn't authorised

Your accounting package, booking system, CRM and newsletter each send from your domain. Each has to be listed separately. Miss one and only that tool's mail fails, which is why the symptom looks so random.

Your SPF record has quietly stopped working

Two SPF records instead of one, or more than ten DNS lookups. Both are permanent errors, both make receivers ignore SPF entirely, and neither produces any warning.

DMARC is published but set to p=none

The setting that monitors and does nothing. It satisfies a checkbox, protects nothing, and lets anyone keep sending as you.

Forwarding and aliases break alignment

info@ forwarding to a personal Gmail, a mailing list rewriting headers, an old web-host relay. SPF breaks on forwarding by design; if DKIM isn't also in place, the forwarded copy fails everything.

A migration left records behind

Moving to Microsoft 365 or Google Workspace without cleaning up the old host's MX and SPF entries. Half the configuration points somewhere you stopped paying for years ago.

Why your own testing never catches it

Email you send to yourself always arrives — same domain, trivially trusted. Email to your bookkeeper always arrives, because they have replied to you a hundred times and their provider has learned that you're wanted. Personal history overrides nearly everything.

The mail that fails is the mail to someone who has never heard from you: the new client, the prospect who filled in your form, the supplier you're quoting for the first time. Exactly the mail whose non-arrival is indistinguishable from disinterest.

How to work out which one is happening to you

1. 01

   Read your public records

   Check what SPF, DKIM, DMARC and MX records your domain actually publishes right now. This is the view Gmail and Microsoft have of you, and it takes seconds.

2. 02

   Write down every system that sends as you

   Mail host, accounting software, invoicing, CRM, newsletter, e-commerce, appointment reminders, the website contact form. Most businesses find five or six. Every one of them needs to be covered.

3. 03

   Turn on DMARC reporting

   A DMARC record with a rua= address makes receiving servers send you daily reports of everything sent in your name — including the senders you forgot about, and anyone spoofing you.

4. 04

   Fix in order, then enforce

   Get every legitimate sender authenticated first. Only then move DMARC from none to quarantine to reject. Enforcing before the picture is complete is how businesses block their own invoices.

What about the content of the message?

It still matters, just later in the process. Once you're authenticated, the usual advice applies and is worth following: avoid link shorteners, don't send a single large image with no text, keep your list clean, and make unsubscribing easy on anything that resembles marketing.

But content advice given to an unauthenticated domain is like rearranging furniture in a house with no front door. Fix the authentication, then tune the message.