Managed IT · Email
For ordinary business email, not newsletters. Usually it’s missing authentication or an app sending as you, and a free Gmail account will tell you which within an hour.
Check SPF, DKIM and DMARC first
Apps sending as you need setting up
Usually fixable within a day
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time on the calendar below. Or call 954-539-5678.
When your everyday email (quotes, invoices, replies to clients) lands in junk, you get paid late and clients start to wonder whether you’ve gone quiet on them. People tend to file it under minor IT irritations, and I think that’s a mistake, because the cause can usually be found and fixed, often within a day.
The usual causes, roughly in order of how often I’d expect to find them: your domain is missing SPF, DKIM or DMARC records, or has them set up wrong; a website form, accounting package or CRM is sending email “from” your domain without permission to do so; forwarding is breaking authentication along the way; or one of your mailboxes has been compromised and is quietly sending spam. The first two account for most cases. Newsletters are a different subject with their own rules, which we cover in email deliverability.
A commercial services company came to us because its proposals and invoices were reaching customers’ junk folders, particularly at larger organizations. We started with the message headers and the delivery reports, which show what the receiving systems actually checked; a spam-score website would only have been a guess.
Their CRM sent mail from a third-party platform using the company’s own address as the visible From. DKIM, though, was signing with the vendor’s domain, and the company’s SPF record didn’t authorize the platform that was actually sending. So DMARC alignment failed for some of the messages. An old marketing list was also generating complaints, which did the domain no favors.
We configured the vendor’s authenticated sending domain, validated that SPF and DKIM now aligned, cleaned the marketing list, and separated transactional messages from bulk campaigns. Then we tested with representative recipients and watched the delivery and bounce trends. To be honest about what that achieves: no DNS change can guarantee inbox placement. What it did was remove an authentication problem we could demonstrate.
Mail providers have been tightening the rules for a few years. Google requires every sender to Gmail to authenticate with SPF or DKIM, and anyone sending more than 5,000 messages a day to use both, plus DMARC. Microsoft followed for Outlook.com, Hotmail and Live addresses: since May 5, 2025, high-volume senders without SPF, DKIM and DMARC have their mail rejected (Microsoft first said Junk, then decided to reject it outright). You probably don’t send 5,000 emails a day. The fact remains that the same signals feed every filter, including the one at your client’s own company. A domain that doesn’t authenticate looks, to a computer, a lot like a domain someone is forging.
You need about an hour, a free Gmail account you control, and access to whoever manages your DNS (usually your domain registrar or IT provider).
If all three pass and mail still goes to junk, the cause is somewhere else.
Website forms sending as you. A common setup has the website send form notifications from your own address ([email protected]) through the web server. The web server isn’t in your SPF record and can’t sign DKIM, so those messages fail, and if you’ve tightened DMARC they get junked or rejected. Fix it by sending through a proper mail service with your domain authenticated, or by sending from an address on a subdomain set up for the purpose. Our article on contact form spam covers the incoming side of the same forms.
Forwarding. If a client forwards your email from one system to another (say, from an old domain to their Gmail), SPF breaks along the way because the forwarding server isn’t yours. DKIM normally survives forwarding, which is one more reason to have it on.
A compromised mailbox. If one of your accounts was phished and is sending spam, receiving systems lower their view of your whole domain, and Microsoft may restrict that user from sending at all. Signs: bounce-backs for messages nobody sent, colleagues getting odd emails “from” a coworker, and inbox rules nobody created that move or delete replies. Reset the password, end the sessions, check the rules, and confirm MFA is on. Then follow what to do if your email is hacked.
The content. Less often than people think, but it matters: an invoice that is only a link to an unfamiliar payment site, link shorteners, an image with no text, or attachments in formats filters dislike. A plain sentence or two and a PDF attachment is the boring, reliable version.
The recipient’s own rules. Sometimes it really is them. A client’s IT team may quarantine anything with a link from a new domain. Ask them to check quarantine and add you as a trusted sender, but only after you’ve confirmed your own house is in order, otherwise you’re just asking them to lower their guard.
If you only do one thing this week, turn on DKIM for your main mail system and publish a DMARC record in monitoring mode. Then work through the other systems that send as you, one by one, until the DMARC reports show them all passing. For most firms with 10 to 100 people, that’s an afternoon of work spread across a couple of days while DNS changes settle. Reputation catches up more slowly, so give it a couple of weeks of clean sending before you judge the results.
If you’d like us to look, our free Technology Health Assessment checks email security and authentication along with the rest of your IT. It takes 30 minutes of data collection and you get a plain-language report the next day, yours to keep. Book a time here. For ongoing help, this is routine work for our managed IT team.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Each receiving system makes its own decision. Outlook.com, Gmail and a client’s own Microsoft 365 tenant all weigh authentication, reputation and their own rules differently. If one client junks everything, ask them to check their quarantine and safe-sender settings, but first make sure your SPF, DKIM and DMARC pass, because that helps everywhere.
Yes. Google and Microsoft’s strictest rules apply to bulk senders, but a DMARC record is free, takes ten minutes, and lets you see who is sending email as your domain. Start with a monitoring policy (p=none) and tighten it once the reports show everything legitimate passes.
It can. If one account starts sending phishing or spam, receiving systems lower their opinion of your domain, and Microsoft may block that user from sending at all. Check for unfamiliar inbox rules and sign-ins, reset the password, and confirm MFA is on.
Most fixes are DNS changes that take effect within hours. Reputation recovers more slowly: if your domain has been sending unauthenticated or spammy mail, give it a couple of weeks of clean sending before judging the result.
