Blog · Email
Why business email ends up in spam, and the DNS records that stop it
By the HostingFast team Published 27 July 2026 7 min read
Few sentences land harder than a customer saying they found it in their spam folder. The invoice, the quote, the proposal you polished all evening, filed between the pills and the princes. When a small business sends from its own domain, the wording of the message is almost never at fault. The fault is authentication: your domain is offering no cryptographic proof that the mail actually came from you.
Since Google and Yahoo hardened their bulk-sender rules in 2024, and they have only ratcheted since, unauthenticated mail no longer gets a friendly assumption. The upside: fixing it means three DNS records, all of them free, and the entire job fits inside twenty minutes.
The three records, translated
SPF is the approved-sender roster. It is a DNS record listing every server permitted to send mail for your domain. Receiving servers compare the sending IP against that roster and fail anything from outside it. One record, one line, and the SPF walkthrough builds it with you.
DKIM is the tamper-proof signature. Your mail server signs each outgoing message with a private key, and the matching public key lives in your DNS for receivers to verify. A valid signature proves the message is genuine and arrived unmodified. Enabling it is one panel toggle plus one record.
DMARC is the standing order. It tells receivers how to treat mail that fails SPF and DKIM, whether to deliver anyway, quarantine or reject, and where to send the reports. Gmail all but requires one from any domain hoping for the inbox. Start at p=none and watch, then tighten the policy once the reports run clean.
Why mail still fails after the records go in
Application mail leaving by the wrong door. A WordPress contact form or invoicing app sends "from" your domain via a server your SPF record has never heard of, so every one of those messages fails. Route application mail through authenticated SMTP instead; for WordPress it is a ten-minute job.
A duplicate SPF record. A domain is allowed exactly one. A second, typically abandoned by an old provider, breaks SPF outright. Merge the pair into a single record.
Sending as your domain from personal webmail. A personal Gmail's "send as" for you@yourdomain without real SMTP authentication fails DMARC at every strict receiver. Your domain's mail belongs on your domain's own mail service.
And one cause DNS cannot touch: history. A domain that leaps from silence to hundreds of identical messages looks exactly like a hijacked mailbox. Ramp new domains up gently, and keep invoices and receipts well clear, in volume terms, of any marketing send.
Twenty minutes, five steps
One, inventory everything that legitimately sends as your domain: the mailbox, your website forms, the invoicing tool. Two, publish a single SPF record covering exactly that inventory. Three, switch DKIM signing on at your mail host and publish the key. Four, publish DMARC at p=none with a reporting address, give it a week, read what comes back, then step up to quarantine. Five, mail a Gmail address and open Show original. Three green PASS lines is the finish line.
On our email hosting, the SPF and DKIM records are generated for every mailbox domain and the panel spells out exactly what to publish, which turns most of the twenty minutes into reading. Every plan includes inbound spam filtering, and domains that need more can put dedicated mail filtering in front of any mailbox, hosted anywhere.
Quick answers
Why does my business email hit spam when it isn't spam?
Nearly always because authentication is absent. Without SPF, DKIM and DMARC, a receiver cannot verify the mail genuinely left your domain, and under the 2024 Gmail and Yahoo rules unverified mail is downgraded by default. The content matters far less than senders assume.
What do SPF, DKIM and DMARC actually do?
SPF publishes the list of servers cleared to send your domain's mail. DKIM stamps each message with a signature proving it is genuine and untouched. DMARC instructs receivers on handling failures, and reports back to you. Between them they decide inbox or junk.
How quickly does deliverability recover once the records exist?
The authentication itself works as soon as DNS propagates, meaning hours. Reputation is slower to rebuild: plan on steady gains across two to four weeks of consistent, authenticated sending.
Up next
Email Hosting
Mailboxes on your own domain, SPF and DKIM ready-made, spam filtering included.
Stop Email Going to Spam (Tutorial)
The practical version, with each record written out in full.
Mail Filtering
Inbound and outbound filtering placed in front of any mailbox.
More from the blog
What web hosting really costs in 2026
The intro rate is bait; the renewal rate is the product you actually bought. Here are the three-year numbers, run in full view.
“Unlimited” web hosting: where the ceilings actually hide
Hardware is finite. 'Unlimited' really means capped in units you've never counted: inodes, CPU seconds and one fair-use clause.
Free domain with hosting: four checks to run before you claim yours
Year one costs nothing, truly. Year two is where the reading starts: the renewal price, the registrant name, and the exit terms.
The platform these posts come from
Flat renewals, limits stated up front, free migration and support that actually writes back — all of it bundled into a plan.
Browse Hosting Plans