Why your enquiry emails go to spam: SPF, DKIM and DMARC for small businesses

The short answer: prove your emails really come from your domain

When an enquiry notification, quote or follow-up email lands in spam, the cause is often not the wording. It's that the receiving mail service can't confirm the email was authorised by the domain it claims to come from. Three DNS records do that job: SPF, DKIM and DMARC. Gmail, Yahoo and Outlook.com now set minimum rules around them, and mail that doesn't meet those rules is more likely to be filtered or refused.

For a small business, the fix is usually an afternoon of careful setup rather than a new email platform. List every system that sends email using your domain, make sure each one is authorised, publish a DMARC record that starts in monitoring mode, and test real messages before you rely on them. This guide explains each step in plain terms, using the mailbox providers' own requirements and the Australian Signals Directorate's guidance.

Authentication is necessary, not sufficient. It tells the receiver who sent the email. Whether it reaches the inbox still depends on whether people wanted it, how often they mark it as spam and how the message is written.

What SPF, DKIM and DMARC each do

All three are published in your domain's DNS, the same place your website and mailbox settings live. Each answers a different question for the receiving server.

SPF on its own has a known gap. The Australian Signals Directorate explains that mail servers check SPF against the hidden envelope sender, while email programs show people the visible From address, so an attacker can pass SPF with their own domain and still display yours. DKIM has a similar gap. DMARC closes both by checking that the domain that passed SPF or DKIM matches the domain in the visible From address. Google calls this alignment, and it's what most deliverability problems come down to.

In short:

• SPF lists the servers and services allowed to send email for your domain. It's a single text record that starts with v=spf1.
• DKIM adds a digital signature to each message, using a key whose public half sits in your DNS. Google requires keys of at least 1024 bits for personal Gmail accounts and recommends 2048 bits where your provider supports it.
• DMARC tells receivers what you'd like done with mail that fails, from none to quarantine to reject, and where to send reports about mail using your domain.

What Gmail, Yahoo and Outlook now require

Since February 2024, Google has required every sender to personal Gmail accounts to set up SPF or DKIM, have valid forward and reverse DNS for sending servers, use a TLS connection and keep reported spam rates below 0.3%. Senders of 5,000 or more messages a day to personal Gmail accounts must also have both SPF and DKIM, a DMARC record (a policy of none is acceptable), a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing messages. Google counts every message sent from the same primary domain towards that 5,000.

Google's FAQ says that starting November 2025, Gmail is ramping up enforcement on non-compliant traffic, including temporary and permanent rejections. Its guidelines warn that unauthenticated messages might be marked as spam or rejected with a 5.7.26 error. Those rules apply to mail sent to personal Gmail addresses; Google says they don't apply to messages sent to Google Workspace accounts, which are business domains hosted by Google.

Yahoo publishes the same structure: SPF or DKIM for all senders, and SPF, DKIM and a DMARC record for bulk senders, who must also honour unsubscribes within 2 days. Microsoft's notice for Outlook.com, Hotmail and Live addresses applies SPF, DKIM and DMARC to domains sending more than 5,000 emails a day from 5 May 2025, and describes failing mail being sent to Junk or rejected.

Most small businesses send far fewer than 5,000 emails a day, so the bulk rules may not strictly apply. Microsoft's answer to that question is still worth reading: "While enforcement first targets large senders, all senders benefit from these best practices." Your customers use these mailbox services, and your quotes and follow-ups are competing with mail that does meet the full standard. If you also send newsletters or promotions, the consent and unsubscribe rules under the Spam Act apply regardless of volume.

Keep readingCheck which automated emails count as marketing under the Spam Act

The website form trap: sending as the customer

Website contact forms cause more of these problems than any other sender. Many form plugins email the enquiry to you from the address the customer typed in, so a notification claims to come from someone@gmail.com while actually being sent by your web server. That's exactly what DMARC is designed to stop. Google's sender guidelines say "Don't impersonate Gmail From: headers" and warn that doing so might affect delivery. Mail that fails DMARC is one of the factors Google uses to decide whether to deliver, filter or reject it, so the notification can disappear before you see it.

Set the form to send from an address on your own domain, such as enquiries@yourbusiness.com.au, and put the customer's address in the Reply-To field. You can still reply with one click, and the message now passes the alignment check because it really does come from your domain.

Then check how the form sends. If it uses your web host's built-in mail function, the host's servers have to be included in your SPF record, which the Australian Signals Directorate specifically mentions: you may need to include web servers that send email directly. A more reliable option is to have the form send through your main mailbox provider or a transactional email service that signs with DKIM for your domain. Test it with a labelled enquiry to a Gmail address and an Outlook.com address, and look at the message headers, not only the inbox.

Keep readingTest the whole enquiry path before you spend

List every service that sends as your domain

Before changing any records, write down everything that sends email with your business's name in the From address. Most small businesses find more than they expected. Each one must either be included in SPF or sign with DKIM for your domain, and preferably both. Microsoft makes the point plainly for businesses that outsource sending: even if a vendor sends the mail, authentication is tied to your domain, so you need to coordinate the DNS settings with them.

Two technical limits catch people out. A domain must publish only one SPF record; RFC 7208, the SPF standard, says a domain "MUST NOT have multiple records" that would be selected for the same check, so adding a second record for a new tool breaks the first. And SPF evaluation is capped at 10 DNS lookups. Each include for a new service uses at least one, and as Microsoft's FAQ puts it, "If you exceed 10 DNS lookups, your SPF check might fail." Merge services into one record and remove tools you no longer use.

Whoever changes these records needs access to your domain's DNS, which is often held by a former web developer or an old hosting account. A typical small business sender list looks like this:

• Your mailbox provider, such as Microsoft 365 or Google Workspace.
• The website contact or quote form.
• Your CRM, booking system or job management software.
• Quoting, invoicing and accounting software that emails documents.
• Newsletter or marketing email tools.
• Automated reminders, review requests and notifications.

Keep readingConfirm who can manage your domain and DNS

Roll out DMARC in stages

The DMARC specification was republished in May 2026 as RFC 9989, which replaces the earlier RFC 7489. It describes the usual path: once SPF, DKIM and a mailbox for reports are in place, domain owners usually start with a policy of p=none and a rua address for aggregate reports. Monitoring mode changes nothing about delivery. It shows you which systems are sending as your domain and which of them fail, so you can fix a forgotten sender before you ask receivers to block failures.

The Australian Signals Directorate is direct about timing: "implement DMARC immediately, even if only in a monitoring mode ('p=none') configuration." Its best practice end state is a DMARC policy that quarantines or rejects all mail failing SPF and DKIM, applies to subdomains too, and sends reports that someone actually reviews.

The reports are machine-readable files, so most small businesses use a reporting service or their IT provider to summarise them. Move to quarantine once the reports show every legitimate sender passing, then to reject after a further quiet period. Older guides suggest phasing in with the pct tag; RFC 9989 removed it because receivers applied it inconsistently. Domains you own but never send from, such as an old business name you keep for redirects, can publish v=spf1 -all so nobody can use them for fake email.

Keep readingPlan your email records if you change domain

A worked example: an electrician's missing quotes

This is a hypothetical example. A two-person electrical business in Geelong notices that some customers say they never received a quote, and a few website enquiries only turn up when someone checks the junk folder. The business uses Microsoft 365 for email, a website form plugin, job management software that emails quotes and invoices, and a newsletter tool used twice a year.

Checking the DNS shows two SPF records: one added when Microsoft 365 was set up and another added later by the job software's setup guide. Under the SPF standard, a receiver that finds both returns an error, so neither record can be relied on. The website form sends notifications from the customer's own address through the web host. There is no DMARC record.

The fix list: merge both into one SPF record covering Microsoft 365 and the job software, and remove the old hosting include. Turn on DKIM in Microsoft 365 and in the job software for the business domain. Change the form to send from enquiries@ the business domain through Microsoft 365, with the customer as Reply-To. Publish DMARC at p=none with a reporting address. After a month of reports, the newsletter tool turns out to be failing alignment, so its DKIM is set up for the domain too. Only then does the business move to quarantine.

Delivery should improve, but the business still checks: it sends test quotes to a Gmail and an Outlook.com address after every change, and asks new customers to confirm a quote arrived.

A checklist for business email that arrives

Work through this with whoever manages your domain and website. If Demandify or another provider sets up your forms, CRM or follow-up automation, it's reasonable to ask them to confirm each item before your next campaign sends enquiries to it:

• Every service that sends as your domain is listed, with an owner.
• One SPF record covers them, within the 10-lookup limit.
• DKIM is switched on for your mailbox provider and each sending service, using your domain.
• Website forms send from your own domain, with the customer in Reply-To.
• A DMARC record is published with a reporting address someone reviews.
• The DMARC policy moves from none to quarantine or reject once reports are clean.
• Domains that never send email publish v=spf1 -all.
• Test messages to Gmail and Outlook.com addresses arrive in the inbox after every change.