Guide · Email

Why your business email goes to spam (and the 3 settings that fix it)

If customers keep saying "your invoice was in my junk folder", the cause is almost never what you wrote. It's usually three settings on your domain that tell Gmail and Outlook the email really came from you. Here is what they are, how to check yours, and what to change.

Published 24 October 2026 · By the What's wrong with my site? team · About a 9-minute read

The 3 settings, in owner terms

All three live in your domain's DNS. (DNS is the public address book for your domain. It's managed wherever you bought the domain or point it, usually GoDaddy, Namecheap, Cloudflare or your web designer's account.) Each setting is one line of text.

SPF: who is allowed to send as you

Think of it as the guest list at the door. It names the services that send your mail: Google, Microsoft, your booking system, your invoicing tool. A Google Workspace business with nothing else would have:

v=spf1 include:_spf.google.com ~all

Two rules trip people up. You can have only one SPF record per domain (two records means both are ignored), and it can only point to about 10 other services' lists before it breaks.

DKIM: the signature on each email

Your email service adds a hidden signature to every message, and publishes the matching public key in your DNS. An inbox checks the signature against the key. If it matches, the message really came through your service and wasn't altered on the way. DKIM is the setting most often left switched off, because Google Workspace and Microsoft 365 don't turn it on for your own domain until you ask.

DMARC: your instructions to inboxes

DMARC says: "If an email claims to be from my domain and fails the checks above, here's what to do with it." The choices are none (deliver it, but send me a report), quarantine (put it in spam) or reject (block it). It also checks that the domain in SPF or DKIM matches the domain in the "From" line people see, which is what stops a stranger from sending as you.

A safe first record looks like this. Our DMARC setup guide walks through adding it at each provider.

v=DMARC1; p=none; rua=mailto:[email protected]

The usual causes

1. A new website, booking or invoicing tool is sending "as you"

This is the most common cause. You start using a booking system, an online store, a contact form, QuickBooks, Square or a newsletter tool, and it sends emails with your address in the "From" line. But it sends from its own servers, which aren't on your SPF list and don't sign with your DKIM key. To Gmail, that looks exactly like spoofing. The fix is in the tool's settings, usually a page called "domain authentication" or "sender verification" that gives you one or two records to add to your DNS.

2. Gmail, Yahoo and Outlook tightened their rules (2024 and 2025)

In February 2024, Google and Yahoo started requiring every sender to pass SPF or DKIM, and anyone sending 5,000 or more messages a day to their users to have SPF, DKIM and DMARC. Microsoft announced similar rules for Outlook.com and Hotmail addresses in 2025. A plumber or a dental office won't hit 5,000 a day, but the inboxes now lean harder on these checks for everyone, so email that "always worked" can start landing in spam without anything changing on your side.

3. No DMARC record at all

Without DMARC, inboxes have no instruction from you and no way to tell your real mail from a fake. You also get no reports, so you can't see who is sending as you. It's one of the most common gaps on small-business domains.

4. A free-mail "From" address on a business tool

If your website form or booking system sends "from" [email protected] or @hotmail.com, it is sending as a domain it has no permission to use. Gmail, Yahoo and Outlook.com publish their own DMARC rules, and mail like this fails them. The fix is to send from an address on your own domain, or let the tool use its own address in "From" and put yours in "Reply-To".

5. Things that look like spam regardless of settings

Settings aren't the whole story. A message that is one big image, a link-shortener link, an attachment people weren't expecting, or a mailing list people didn't sign up for can still land in spam with perfect settings. Fix the three settings first; they're the part you control in an afternoon.

Check your own domain in 5 minutes

Gmail's "Show original" (the best single test)

1. From your business email, send a short message to a personal Gmail address.
2. Open it in Gmail on a computer, click the three dots at the top right of the message, and choose Show original.
3. Near the top you'll see three lines: SPF, DKIM and DMARC, each with PASS or FAIL. All three should say PASS, and the DKIM line should mention your own domain, not your email provider's.

Do the same test from every tool that sends as you: request a booking on your own website, send yourself an invoice, submit your contact form. Each one is a separate sender, and each one needs to pass.

In Outlook, the equivalent is opening the message and choosing View message source (or "View message details"), then searching for Authentication-Results.

Look up your records

Free lookup tools such as MXToolbox (mxtoolbox.com) have an SPF lookup and a DMARC lookup: type your domain and they show what's published and flag obvious mistakes, like two SPF records or a missing DMARC record.

Or use our free check below. It reads your SPF and DMARC and explains the results in plain English. It can't see DKIM, because DKIM keys are stored under names only your email service knows, so use the Gmail test for that.

What to change: Google Workspace, Microsoft 365, GoDaddy

Whatever your email provider, the order is the same: SPF first, then DKIM, then DMARC at p=none. Add records wherever your domain's DNS lives, which isn't always the same company as your email. The menus below are current as we write this, but providers rename them often; if a step doesn't match, search their help pages for the setting name.

Google Workspace

• SPF: one TXT record on your main domain (host @): v=spf1 include:_spf.google.com ~all. If other services send as you, add their include: to this same line rather than creating a second record.
• DKIM: in the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email. Generate a new record (2048-bit if your DNS host accepts it), add the TXT record it gives you (host google._domainkey), wait for it to show up, then click Start authentication. Until you click that, Google signs with its own domain, not yours.
• DMARC: a TXT record at host _dmarc: v=DMARC1; p=none; rua=mailto:[email protected]

Microsoft 365 (Outlook for business)

• SPF: one TXT record on your main domain: v=spf1 include:spf.protection.outlook.com -all, plus any other senders.
• DKIM: in the Microsoft Defender portal (security.microsoft.com), go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Pick your domain. It shows two CNAME records (hosts selector1._domainkey and selector2._domainkey). Add both to your DNS, then come back and switch signing on. Copy the values exactly as shown: Microsoft changed their format in 2025, so older guides list values that won't match yours.
• DMARC: the same _dmarc TXT record as above.

GoDaddy (domain, Professional Email, or Microsoft 365 bought through GoDaddy)

• Where: sign in, open your Domain Portfolio, pick the domain, then DNS. Records are added with "Add New Record". In the Name (host) box type only the part before your domain, for example _dmarc; GoDaddy adds the rest.
• Look before you add. GoDaddy often creates SPF and sometimes DMARC records for you. If an SPF line (starting v=spf1) or a _dmarc line already exists, edit it instead of adding a second one.
• GoDaddy Professional Email: its SPF entry is usually include:secureserver.net. Check the email settings in your GoDaddy account for the exact records to use, including DKIM.
• Microsoft 365 from GoDaddy: follow the Microsoft 365 steps above. GoDaddy usually adds the SPF record when the account is set up; DKIM still has to be switched on in the Defender portal.

After each change, wait an hour (sometimes up to a day) and repeat the Gmail "Show original" test.

Questions owners ask

Related: DMARC setup for a small business, step by step · All guides · Sources we check against