Why are my business emails going to spam?

The main reasons emails go to spam

1. No email authentication. Missing or broken SPF, DKIM or DMARC records are the most common cause for small businesses.
2. Two SPF records. Adding a second SPF record when you add a new service, instead of merging them, makes SPF fail completely.
3. Website mail sent badly. Contact forms and shop order emails sent with PHP mail() from the web server, pretending to come from your Microsoft 365 or Google address, often fail checks.
4. Poor sending reputation. A shared server or IP address that has sent spam, or a compromised mailbox, can drag you down.
5. Blocklisting. Your server IP or domain is on a public blocklist.
6. Content and habits. Link-heavy messages, image-only emails, URL shorteners and sending to old lists raise spam scores.

How to check what is wrong

Work through these checks before changing anything.

• Look at the message headers. Send an email to a Gmail account, open it, choose "Show original" and read the SPF, DKIM and DMARC results. Each should say PASS.
• Look up your DNS records. Check the TXT records on your domain for one record starting v=spf1 and one at _dmarc starting v=DMARC1.
• Check who sends mail as you. List every service: your mailbox provider, website, newsletter tool, CRM, invoicing software. Each needs to be covered.
• Check blocklists for your sending IP using a reputable blocklist checker.

How to fix it

1. Publish one SPF record that includes every legitimate sender, for example your mailbox provider and your newsletter tool, ending in ~all or -all.
2. Turn on DKIM in each service that sends for you and add the DNS records it gives you, usually CNAME or TXT records.
3. Add a DMARC record starting at p=none so you receive reports, then move to p=quarantine once everything passes.
4. Send website mail properly. Configure your CMS to send through authenticated SMTP using a real mailbox, rather than the server's PHP mail().
5. Fix any compromised accounts, change passwords and request removal from blocklists once clean.

Our step-by-step guide How do I set up SPF, DKIM and DMARC? shows example records.

Where your email is hosted matters

Many small businesses use Microsoft 365 or Google Workspace for mailboxes and keep the website on separate hosting. That works well, as long as DNS is set up so both are authorised. Others keep email with their website: dijitul Complete Hosting includes 10 POP3/IMAP email accounts on your domain, with SPF, DKIM and DMARC set up for them. If you are deciding where mail should live, see email hosting vs Microsoft 365 and our email hosting page.

Whichever you choose, keep a simple list of every service allowed to send as your domain, and review it when you add a new tool. Newsletter platforms, booking systems, accounting software and CRMs all send mail that can fail authentication if they are not added to SPF and set up for DKIM. If you send large marketing campaigns, use a separate subdomain such as news.example.co.uk, so a problem with a campaign does not affect everyday business email.

How dijitul helps

dijitul Complete Hosting includes Cloudflare DNS set up and managed for you. That means we can add and merge your SPF record, publish DKIM and DMARC for your mail provider, and configure your website to send mail through authenticated SMTP. It costs £1 a day + VAT (£365 a year + VAT), with managed hosting, 10 POP3/IMAP email accounts, daily backups kept for 14 days, free SSL and UK-based support. If you use Microsoft 365 or Google Workspace instead, we set up the DNS for those. Order Complete Hosting or call 01623 650333 and we will look at your records with you.

Related