Blog · Email
Business email landing in spam, and the DNS records that fix it
By the Hosting Seller team Published 27 July 2026 7 min read
There is a particular sinking feeling when a customer says they found it in spam. Your invoice, your quote, the proposal you spent an evening on, filed between the pills and the princes. For a small business sending from its own domain, the wording of the message is almost never the reason. The reason is authentication: your domain is not proving, cryptographically, that the mail came from you.
Since Google and Yahoo tightened their bulk-sender rules in 2024, and the screws have only turned since, unauthenticated mail no longer gets the benefit of the doubt. The good news is that authentication comes down to three DNS records, they cost nothing, and the whole job fits inside twenty minutes.
The three records in plain English
SPF is the guest list. It is a DNS record naming the servers allowed to send mail for your domain. The receiving server compares the sender's IP against that list, and anything sent from elsewhere fails. One record, one line, and the SPF walkthrough writes it alongside you.
DKIM is the wax seal. Your mail server signs each outgoing message with a private key, and the matching public key sits in your DNS for receivers to check. A valid signature proves the message was neither forged nor altered on the way. Turning it on is a toggle in the panel plus one record.
DMARC is the instruction card. It tells receivers what to do when SPF and DKIM fail, whether to deliver anyway, quarantine or reject, and where to post the reports. Gmail effectively expects one from any domain that wants the inbox. Begin at p=none and watch, then tighten the policy once the reports come back clean.
Why authenticated mail still lands in spam
Application mail taking the wrong road. Your WordPress contact form or invoicing app sends "from" your domain through a server that is not on your SPF list, and every one of those messages fails. Route application mail through authenticated SMTP instead, which for WordPress takes ten minutes.
Two SPF records. A domain may have exactly one. A second, usually left behind by a previous provider, makes SPF fail permanently. Merge them into a single record.
Sending as your domain from personal webmail. Using a personal Gmail's "send as" for you@yourdomain without proper SMTP authentication fails DMARC at every strict receiver. Send your domain's mail through your domain's own mail service.
And one factor that has nothing to do with DNS: history. A domain that jumps from nothing to hundreds of identical messages looks like a hijacked mailbox. Warm new domains up gradually, and keep invoices and receipts separate, in volume terms, from any marketing send.
The 20-minute checklist
One, list everything that legitimately sends as your domain: the mailbox, your website forms, your invoicing tool. Two, publish a single SPF record covering exactly that list. Three, switch DKIM signing on at your mail host and publish the key. Four, publish DMARC at p=none with a reporting address, wait a week, read what comes back, then move to quarantine. Five, send a test to a Gmail address and open Show original. Three green PASS lines is the finish line.
On our email hosting the SPF and DKIM records are generated for every mailbox domain and the panel shows exactly what to publish, so most of the twenty minutes is reading. Inbound spam filtering is on every plan, and for domains with heavier filtering needs there is dedicated mail filtering that sits in front of any mailbox, wherever it is hosted.
Short answers
Why do my business emails go to spam even though they're not spam?
Almost always because authentication is missing. Without SPF, DKIM and DMARC, a receiving server cannot confirm the mail is really from your domain, and since the 2024 Gmail and Yahoo rules unauthenticated mail is demoted by default. Content matters far less than owners think.
What are SPF, DKIM and DMARC in simple terms?
SPF is a public list of the servers allowed to send your domain's mail. DKIM is a signature proving each message is genuine and unaltered. DMARC tells receivers what to do when those checks fail, and reports back to you. Together they decide inbox or junk.
How long until deliverability improves after adding the records?
Authentication starts working as soon as DNS propagates, so hours. Reputation takes longer to rebuild: expect steady improvement across two to four weeks of consistent, authenticated sending.
Also on the blog
Web hosting costs in 2026: the whole bill
The tag on the shelf is advertising. The renewal is the product. Here is the three-year arithmetic, worked out in the open.
“Unlimited” web hosting: where the limits really sit
Disks have sizes. 'Unlimited' translates to 'limited by units you haven't met yet': inodes, CPU seconds and a fair-use paragraph.
Free domain with hosting: four things to check before you claim one
The free year is genuine. Year two is where the questions live: renewal rate, whose name is on the record, and what leaving costs.
The product behind the posts
Flat renewals, limits printed on the tin, free migration and a help desk that replies — everything above, in plan form.
Browse Hosting Plans