Why your quotes land in spam

Why your quotes land in spam usually comes down to three DNS records on your domain: SPF, DKIM and DMARC. If they're missing or wrong, the customer's mail provider can't confirm the email really came from you, so it plays safe and files it as junk.

What SPF does

SPF (Sender Policy Framework) is a list of the services allowed to send email for your domain. It lives in a single TXT record. When a customer's mail server receives your quote, it checks whether the sending server is on that list.

The common mistake is an SPF record that only lists your mailbox provider. Your accounts package, your job system and your website form may all send mail as your domain too. If they're not listed, their emails fail. You're also allowed only one SPF record per domain, and the standard caps it at ten DNS lookups, so piling in every service you've ever tried breaks it.

What DKIM does

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The matching public key sits in your DNS. The receiving server checks the signature, which proves the message came from an authorised sender and wasn't altered on the way.

DKIM isn't always switched on for your own domain by default. In Microsoft 365 you add two CNAME records, selector1 and selector2, then turn on DKIM signing in the Defender portal. In Google Workspace you generate a key in the Admin console under Gmail, then Authenticate email, publish it as a TXT record, and click Start authentication.

What DMARC does

DMARC tells receiving servers what to do when an email claiming to be from you fails SPF and DKIM. The policy can be none (just report), quarantine (send to junk) or reject. It also asks receivers to send you reports, which is how you find the forgotten system that sends as your domain.

DMARC also checks alignment. The domain in the From address has to match the domain that passed SPF or DKIM. Google's sender guidelines require this for anyone sending more than 5,000 messages a day to Gmail, and say every sender needs SPF or DKIM at minimum. If you send fewer, Google still recommends all three.

Third-party senders: Xero and job systems

Systems like Xero, job management tools and website forms often send invoices and quotes on your behalf. Some send from their own address with your email as the reply-to. Others send as your domain. The second kind needs adding to your SPF record or setting up with DKIM, following that provider's own instructions. Check each one's help pages rather than guessing, because the records differ. A sender that isn't set up is one reason why your quotes land in spam while ordinary emails arrive fine.

If quotes still sit in email threads and spreadsheets, our piece on quotes and invoices stuck in email covers the wider fix.

How to check your own domain

You can do this yourself with free tools.

First, send a quote to a personal Gmail address. Open it, click the three dots next to Reply and choose Show original. Gmail shows SPF, DKIM and DMARC results near the top. Each should say PASS.

Second, put your domain into the MxToolbox SPF check and the MxToolbox DMARC check. They show the record and flag errors. Google's Check MX tool does a similar check and can test a DKIM selector.

Third, repeat the Gmail test for each system that sends on your behalf: invoices, quotes, booking confirmations, website form replies. Each one passes or fails on its own.

SPF vs DKIM vs DMARC: quick comparison

• SPF: a list of servers allowed to send as your domain. One TXT record per domain.
• DKIM: a signature on each email, checked against a public key in your DNS. Set up per sending service.
• DMARC: a policy for failed emails, plus reports back to you. One TXT record at _dmarc on your domain.

What to do next

Start DMARC at none, read the reports for a few weeks, fix each sender, then move to quarantine. Moving to reject before every sender passes can get your own invoices rejected. If quotes are going missing today, the fix is usually in your DNS records, not a new email provider.

Our managed websites include domain registration and branded email on your own domain, with direct contact with the engineers who built it. If your quotes and invoices keep ending up in junk, talk to an engineer and we'll look at your domain with you.