Why is my business email going to spam?

Business email usually goes to spam because your domain is missing three security records - SPF, DKIM and DMARC - that prove your email is genuinely from you. Without them, providers like Gmail and Outlook cannot verify your mail, so they treat it as suspicious. Setting up all three, correctly, fixes the problem in most cases within a day or two.

If your quotes, invoices and replies keep landing in clients' junk folders, it is rarely bad luck and almost never the message. It is your domain's reputation and, most often, missing authentication records. Here is what is going wrong and how to fix it.

What actually sends email to spam?

Spam filters send your email to junk when they cannot confirm it really came from your domain. The three records that confirm it - SPF, DKIM and DMARC - are the single most common thing small businesses have set up wrong or not at all.

In plain terms:

• SPF lists which servers are allowed to send email for your domain.
• DKIM adds a tamper-proof signature that proves the message was not altered.
• DMARC tells receiving servers what to do if SPF or DKIM fail, and reports back to you.

Get all three right and you are telling Gmail and Outlook, in a language they trust, that your mail is legitimate. Google and Yahoo now require them for anyone sending in volume, as detailed in Microsoft's email authentication guidance.

Best practice: Set up SPF, DKIM and DMARC together rather than one at a time, because providers only trust your mail once all three line up.

How do I check if my records are the problem?

Send an email from your business address to a Gmail account, open it, and use the show original option to see whether SPF, DKIM and DMARC each say pass. If any say fail or none, that is your culprit.

Tip: Send yourself a test to a Gmail account and read the authentication results before changing anything, so you fix the record that is actually failing.

This two-minute check tells you more than an hour of guessing. If all three pass and mail still lands in spam, the problem is more likely your domain's reputation or the content of the message, covered below.

What else sends email to junk?

Beyond authentication, a handful of habits quietly wreck deliverability. The usual suspects:

• A new or unused domain with no sending history, so no reputation yet.
• Spam-trigger content - all caps subject lines, too many links, or one giant image and no text.
• Sending bulk email from your normal mailbox instead of a proper marketing tool.
• A previous owner having burned the domain's reputation before you bought it.
• Being listed on a blocklist, often after a mailbox was hacked and used to send spam.

That last one links straight to security. A compromised account is one of the fastest ways to land on a blocklist, which is why multi-factor authentication matters, see what is MFA and the cyber security essentials guide.

Warning: A hacked mailbox can get your whole domain onto a blocklist, so turning on MFA protects your deliverability as much as your data.

How do I fix it for good?

Set up SPF, DKIM and DMARC correctly for your domain, then keep bulk email off your main mailbox. On Microsoft 365, DKIM and SPF take a few minutes each in the admin centre, and DMARC is a single DNS record you add gradually.

The catch is that a wrong SPF record is worse than none, and DMARC set too strict on day one can block your own legitimate mail. It is worth doing carefully or having someone do it once, properly. This is part of every setup in our Microsoft 365 service, and it ties into the wider guide, Microsoft 365 for small business, done right.

The short version

Business email going to spam is almost always missing or broken SPF, DKIM and DMARC records. Check them with a Gmail test, set all three up correctly, keep your accounts secure and your bulk sending separate, and your mail will start landing where it should.

Frequently asked questions

Why is my business email going to spam all of a sudden?

A sudden change usually means a broken authentication record, a new blocklisting, or a compromised account sending spam in your name. Check SPF, DKIM and DMARC first, then confirm no mailbox has been hacked.

What are SPF, DKIM and DMARC?

They are three DNS records that prove your email is genuinely from your domain. SPF lists allowed senders, DKIM signs each message, and DMARC tells receivers what to do if the first two fail.

How long does it take to fix email deliverability?

Once the records are set correctly, most improvement shows within 24 to 48 hours as DNS updates spread. Rebuilding a badly damaged domain reputation can take a few weeks of consistent, legitimate sending.

Can I send newsletters from my normal email address?

You can, but you should not. Bulk email from your main mailbox hurts your domain reputation and lands in spam. Use a dedicated marketing platform that handles authentication for bulk sending.

Does Microsoft 365 fix spam issues automatically?

No. Microsoft 365 makes SPF and DKIM easy to configure, but you still have to set them up and add DMARC yourself. They are not switched on correctly by default.

Not sure whether your email is set up right? Take the free business health check and we will test your deliverability for you.