Blog · Email
Why business email lands in spam, and which DNS records put a stop to it
By the HostingFast team Published 27 July 2026 7 min read
Almost nothing stings like a customer telling you it turned up in their spam folder. The invoice, the quote, the proposal you polished all evening, filed somewhere between the pills and the princes. Where a small business sends from its own domain, the wording of the message is hardly ever the problem. Authentication is: your domain offers no cryptographic proof that the mail genuinely came from you.
Google and Yahoo hardened their bulk-sender rules back in 2024, and the screws have kept turning since, so unauthenticated mail gets no benefit of the doubt any more. Here is the good part. Three DNS records fix it, none of them cost anything, and the whole job fits into twenty minutes.
The three records, translated
SPF is the approved-sender roster. It is a DNS record listing every server permitted to send mail for your domain. Receiving servers compare the sending IP against that roster and fail anything from outside it. One record, one line, and the SPF walkthrough builds it with you.
DKIM is the tamper-proof signature. Your mail server signs each outgoing message with a private key, and the matching public key lives in your DNS for receivers to verify. A valid signature proves the message is genuine and arrived unmodified. Enabling it is one panel toggle plus one record.
DMARC is the standing order. It tells receivers how to treat mail that fails SPF and DKIM, whether to deliver anyway, quarantine or reject, and where to send the reports. Gmail all but requires one from any domain hoping for the inbox. Start at p=none and watch, then tighten the policy once the reports run clean.
Why mail still fails after the records go in
Application mail leaving by the wrong door. A WordPress contact form or invoicing app sends "from" your domain via a server your SPF record has never heard of, so every one of those messages fails. Route application mail through authenticated SMTP instead; for WordPress it is a ten-minute job.
Two SPF records on one domain. The spec permits exactly one. A second, usually left behind by a previous provider, breaks SPF completely. Fold the pair together into a single line.
Sending as your domain out of personal webmail. A private Gmail account using "send as" for you@yourdomain, with no real SMTP authentication behind it, fails DMARC at every strict receiver. Mail for your domain belongs on the mail service that domain runs.
Then there is one cause DNS cannot reach: history. A domain that jumps from silence to hundreds of identical messages looks precisely like a hijacked mailbox. Bring new domains up slowly, and keep invoices and receipts well away, in volume terms, from anything you send as marketing.
Twenty minutes, five steps
Begin by writing down everything with a legitimate reason to send as your domain: the mailbox, your website forms, whatever tool raises invoices. Next, one SPF record that covers that list and stops there. After that, turn DKIM signing on wherever your mail is hosted and publish the key. Now DMARC, set to p=none, with an address for reports. Wait a week. Read what comes back before stepping up to quarantine. Finally, send a message to a Gmail address and open Show original. Three lines reading PASS in green means you have arrived.
On our email hosting, the SPF and DKIM records are generated for every mailbox domain and the panel spells out exactly what to publish, which turns most of the twenty minutes into reading. Every plan includes inbound spam filtering, and domains that need more can put dedicated mail filtering in front of any mailbox, hosted anywhere.
Quick answers
Why does legitimate business email of mine keep landing in spam?
Almost always because authentication is missing. With no SPF, DKIM or DMARC in place, a receiver has no way to confirm the mail really left your domain, and the 2024 Gmail and Yahoo rules downgrade unverified mail as standard. Content matters far less than senders think.
What do SPF, DKIM and DMARC actually do?
SPF publishes which servers may send mail for your domain. DKIM stamps each message with a signature showing it is genuine and untampered. DMARC tells receivers what to do when a check fails, and sends reports back to you. Together they decide inbox or junk.
How soon does deliverability recover after the records go live?
Authentication starts working the moment DNS propagates, so count in hours. Reputation takes longer to rebuild. Expect steady gains over two to four weeks of consistent sending, all of it authenticated.
Up next
Email Hosting
Mailboxes on a domain you own, SPF and DKIM prepared for you, filtering built in.
Stop Email Going to Spam (Tutorial)
The hands-on version, every record spelled out line by line.
Mail Filtering
Inbound plus outbound filtering, sat in front of whichever mailbox you use.
More from the blog
What web hosting really costs in 2026
That opening price is the hook. What renews is the thing you signed up for. Below, the three-year arithmetic, worked out in the open.
“Unlimited” web hosting: the ceilings nobody puts on show
Hardware runs out. 'Unlimited' really translates to capped in units nobody ever counts: inodes, CPU seconds, and a single fair-use clause.
Free domain with hosting: run these four checks before you claim one
Nothing to pay in year one. That much is true. Year two is where you start reading: renewal price, registrant name, terms for leaving.
The hosting platform behind these posts
Flat renewals, limits stated up front, free migration and support that actually writes back — all of it bundled into a plan.
Browse Hosting Plans