If you are asking why are my emails going to spam, you are not alone — it is one of the most common and most frustrating problems a small business faces. You send a quote, an invoice, or a simple reply, and it quietly drops into the customer's junk folder. They never see it. You look unprofessional, or worse, unreachable.
The good news: legitimate business email almost never lands in spam by accident. It happens for a small number of specific, fixable reasons. This guide explains what actually triggers the spam filter and gives you a clear checklist to fix it.
How Spam Filters Decide Where Your Email Goes
When you send an email, the receiving server (Gmail, Microsoft 365, your customer's mail host) runs a series of checks in a fraction of a second. It is essentially asking one question: can I trust that this email really came from who it claims to come from?
To answer that, it checks three published records tied to your domain — SPF, DKIM, and DMARC — and weighs them against your sending history, the content of the message, and whether your sending server appears on any blacklists. If the answer is "I am not sure who this is," the safe choice for the filter is the junk folder.
This matters more than ever because email spoofing and Business Email Compromise (BEC) — where criminals forge your domain to defraud your customers — are widespread. Mailbox providers now treat unauthenticated mail with real suspicion. If your domain has not proven it is legitimate, you are competing for the inbox against every scammer who has ever forged a sender address.
The Real Causes — Email Authentication Gaps
The single biggest reason small-business email goes to spam is missing or broken email authentication. There are three records, and they work together.
Missing or weak SPF. SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for your domain. The receiving server checks the address your mail was sent from at the server level against that list. If you have no SPF record, receivers cannot confirm your mail server is authorised. A weak or outdated SPF record is just as bad — for example, one that does not include your actual email provider (Microsoft 365, Google Workspace), your CRM, or your invoicing tool. Every service that sends on your behalf must be listed.
No DKIM signing. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message using a key published in your domain's DNS. It proves the message really was signed by your domain and that the key parts of it were not altered in transit. Without DKIM, an email is easier to forge and more likely to be flagged. Most providers can enable DKIM with a couple of DNS records, but it is frequently left switched off.
No DMARC policy. DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails. Importantly, it does this through alignment — it checks that the domain shown in the visible "From" line matches the domain that passed SPF or DKIM. That is what makes DMARC the control that actually stops criminals forging your exact domain. One honest limit worth knowing: DMARC protects the precise domain it is published on. It does not stop lookalike domains — a scammer registering your-company-invoices.com is a separate problem (staff training and monitoring), not something a DMARC record can block. A domain with no DMARC record at all looks unmanaged to mailbox providers. We cover the full setup in our guide on how to add DMARC to your Irish business email — start with a p=none policy to monitor, then tighten to p=quarantine and eventually p=reject once you have confirmed your legitimate mail passes.
If you only fix one category of problem, fix this one. SPF, DKIM, and DMARC together account for the majority of avoidable spam-foldering.
Sender Reputation and Blacklists
Even with perfect authentication, your domain and the IP address you send from carry a reputation. Mailbox providers track how recipients react to your mail over time.
Poor sender reputation. If people mark your messages as spam, if you send to addresses that bounce, or if your sending volume spikes suddenly, your reputation drops. A low reputation means even genuine mail gets filtered.
Blacklists (DNSBLs). Services like Spamhaus maintain lists of IP addresses and domains known to send spam. If your sending IP ends up on one — often because of a compromised account, a misconfigured server, or simply sharing an IP with a bad neighbour — receivers will reject or junk your mail. You can check the major blacklists for free, and most reputable providers have a removal (delisting) process once the underlying issue is fixed.
Shared-IP problems. Many small businesses send through shared infrastructure, where your mail goes out from an IP also used by other customers. If one of them gets blacklisted, you can be caught in the crossfire. This is one reason a well-run mail provider matters.
Missing PTR / reverse DNS. A PTR record (reverse DNS) maps your sending IP back to a hostname. Receiving servers expect a valid, matching reverse-DNS entry for a legitimate mail server. A missing or mismatched PTR record is a classic red flag that pushes mail to spam. If you use a hosted provider (Microsoft 365, Google Workspace), this is handled for you; if you run your own mail server, confirm your host has set it.
List Hygiene and Message Content
Two further causes are entirely within your control.
Poor list hygiene. Sending to old, purchased, or unverified email lists is one of the fastest ways to wreck your reputation. Dead addresses bounce, spam traps get hit, and recipients who never asked to hear from you hit "report spam." Only ever email people who gave you their address, and remove addresses that bounce or that unsubscribe.
Spammy content and links. Filters also read the message itself. Things that hurt you: ALL CAPS subject lines, "FREE!!!" style hype, a single giant image with almost no text, link shorteners that hide the real destination, and links to domains with bad reputations. Write like a person, not a billboard. Keep a sensible balance of text to images, and link only to your own well-regarded domains.
Your Fix Checklist
Work through these in order. The first three deliver the biggest improvement.
- Publish a correct SPF record that includes every service sending mail for you — your email provider plus any CRM, newsletter, or invoicing tools.
- Enable DKIM signing in your email provider and publish the DNS records it gives you.
- Add a DMARC record, starting at
p=noneto monitor, then moving top=quarantineandp=rejectonce your legitimate mail passes cleanly. - Check the major blacklists (Spamhaus and others) for your sending domain and IP, and start any delisting process if you are listed.
- Confirm reverse DNS (PTR) is set correctly for your sending IP — ask your provider if unsure.
- Clean your mailing list — remove bounces, never buy lists, and only mail people who opted in.
- Review your message content — drop the hype, balance text and images, and avoid link shorteners.
- Watch your DMARC reports over the following weeks to confirm everything legitimate is passing and nothing is being spoofed.
Find Out Which of These You Fail — Free
You do not have to guess which of these problems applies to you. Our free Digital Trust Checker scans your domain in seconds and gives you a plain-English letter grade across DNS, email authentication (SPF, DKIM, DMARC), TLS, and web security — with a clear "why" for each item that fails.
Run a free check now and you will see exactly which of the causes above are sending your email to spam — and what to fix first. For most small businesses, sorting out SPF, DKIM, and DMARC turns the problem around within a day or two of the DNS changes taking effect. Your customers get your invoices, your replies reach the inbox, and your domain stops looking like a soft target for spoofing.