You send a quotation to a prospect. They never reply. You assume they are not interested — but the email is sitting in their spam folder, and neither of you knows it.
This is one of the most common and most fixable problems we see. The cause is almost never the words you used. It is that receiving servers cannot verify that your email genuinely came from your domain.
How receiving servers decide
When Gmail or Microsoft 365 receives your email, it asks three questions:
- Did this come from a server your domain actually authorises? (SPF)
- Is the message intact, or was it altered in transit? (DKIM)
- What should I do if either of those checks fails? (DMARC)
If the answers are missing or wrong, your mail is treated as unverified. It does not matter how legitimate you are.
The three records, in plain language
| Record | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send mail for your domain | A TXT record on your root domain |
| DKIM | Adds a cryptographic signature so tampering is detectable | A TXT record on a selector subdomain |
| DMARC | Tells the receiver what to do and where to send reports | A TXT record on _dmarc |
Check your own domain in five minutes
Paste your domain into a public SPF/DKIM/DMARC checker. You are looking for three green ticks. If any is missing, that is your problem, and it is fixable.
The single most common failure is an SPF record that ends in -all (hard fail) while the actual sending service is not listed. That is a self-inflicted instruction to reject your own mail.
The trap almost everyone falls into
You set up SPF and DKIM correctly. Mail delivers. Then you add a website contact form, or a newsletter tool, or a CRM — and delivery breaks again, because the new sender is not in your SPF record.
Every service that sends email on your behalf needs to be authorised. Adding one without updating DNS silently breaks the rest.
Keep a list of every system that sends as your domain. When something new is added, update SPF the same day.
Start in monitor mode, not enforce mode
DMARC has three modes: p=none (monitor), p=quarantine, and p=reject. Going straight to reject is tempting and risky — if a legitimate sender is not authorised, you will silently lose that mail.
- Set
p=nonewith a reporting address. - Collect reports for two to four weeks.
- Authorise every legitimate sender you find.
- Move to
quarantine, then toreject.
What good looks like
- SPF: one record, under the 10-lookup limit, listing every real sender.
- DKIM: signing enabled, key rotated at least yearly.
- DMARC: at
p=rejectorp=quarantine, with reports going somewhere a human reads. - A written list of who is allowed to send as your domain.
None of this costs money. It takes an afternoon, and it is the difference between your invoice arriving in an inbox and vanishing into spam.
Need a hand? Talk to a specialist — we check SPF, DKIM and DMARC as part of every email setup.