Blog post overview and metadata
Author, publish date, read time, and category
Why Your Business Email Goes to Spam: SPF, DKIM and DMARC Explained
Reviewed by: ARS Developer Team | Updated: 30 Sep 2026 | UK Focus: Buyer-intent SEO, web delivery, and measurable conversion growth.
Quick Summary
Enquiry notifications landing in junk, invoices never arriving, order confirmations going missing. Almost always the same three DNS records — here is what they do and how to set them.
In This Guide
Why This Article Is Trustworthy
- Reviewed by the ARS Developer editorial team for UK business relevance.
- Structured around buyer-intent SEO, technical delivery, and measurable conversion outcomes.
- Connected to related service pages, pricing guidance, and supporting articles for stronger topic depth.
Quick Answer
If your website's emails are going to junk, the cause is almost never the wording. It is that your domain has not told the receiving mail server which servers are allowed to send on its behalf, so a message claiming to be from you cannot be distinguished from one that is not.
What the three records actually do
SPF is a list, published in your DNS, of the servers permitted to send email using your domain. The receiving server checks whether the message came from one of them. It is the easiest to set up and the easiest to break, because every service that sends on your behalf — your website, your mailing list, your invoicing software — has to be in the list.
DKIM adds a cryptographic signature to each message, so the receiver can confirm it was genuinely sent by an authorised system and has not been altered. DMARC then tells the receiver what to do when SPF and DKIM disagree with each other, and asks it to report back.
The mistake that breaks half of all setups
A domain may publish only one SPF record. Businesses acquire a second when a new service asks them to add one — the website host, then an email marketing platform — and the result is not two lists but an invalid configuration that some receivers treat as a failure.
The fix is to merge everything into a single record with one include per service. While you are there, check the ending: `~all` asks receivers to treat unlisted senders with suspicion, `-all` asks them to reject outright. Move to the stricter setting only once you are confident the list is complete.
Introduce DMARC gradually
Publishing a DMARC record set to reject before you know which systems send as your domain is how a business discovers, on a Monday morning, that its accounting software's invoices have stopped arriving. Almost every organisation has a forgotten sender somewhere.
Start at `p=none` with a reporting address. That changes nothing about delivery but produces reports naming every system sending as you. Run it for a few weeks, fix or authorise what appears, then move to quarantine and only afterwards to reject.
Send transactional mail through a service, not the web server
Contact form notifications and order confirmations sent by PHP's mail function from a shared host go out from an IP address shared with hundreds of other sites, with no authentication and no delivery reporting. When one of those neighbours sends spam, your mail suffers with it.
Routing transactional email through a dedicated provider gives you authentication, a reputation you control, and a log showing whether each message was delivered, bounced or opened. The last of those is worth the change on its own — the difference between "the customer says they never got it" and knowing.
Frequently Asked Questions
Can I have two SPF records?
No. A domain may publish only one, and a second makes the configuration invalid. Merge every sending service into a single record.
How long do DNS changes take?
Usually minutes to a few hours, governed by the TTL on the record. Lower the TTL before making changes if you want to iterate quickly.
Is DMARC required?
Not legally, but the large mailbox providers increasingly expect it from bulk senders, and without it SPF and DKIM failures are handled inconsistently.
Will this fix emails going to a customer's junk folder?
It removes the most common technical cause. Content, sending volume and prior recipient behaviour also matter, but authentication is the part you control outright.
Next Step
If enquiries from your website are not arriving reliably, the DNS is the first place to look. Send us the domain and we can tell you what is currently published.
Next Step Resources
Move from research into action with the most relevant service, proof, pricing, and project planning pages for this topic.
Tags:
Leave a Comment
Ask a practical question, share a project insight, or add a useful note. Every comment is reviewed before it appears publicly.