A customer says they never got your quote. You find it in your sent folder, and it went out at 9:14 that morning. Nobody is lying. It arrived, and it landed in a folder nobody opens.
This is almost never about the words in the email. It is about whether the receiving mail server can prove the message really came from you.
The three records that decide it
Your domain publishes DNS records. Three of them are about mail, and together they answer one question: is this sender allowed to use this domain?
SPF is a list of the servers permitted to send mail as your domain. It lives in a TXT record and looks roughly like v=spf1 include:spf.protection.outlook.com -all. If you use Microsoft 365, that include is what authorizes Microsoft’s servers. Every other system that sends mail as you needs to be in that same record.
Two rules trip people constantly. You get exactly one SPF record. Publishing two is worse than publishing none, because receivers treat a duplicate as a permanent error. And the record is limited to ten DNS lookups. Stack up your mail host, your newsletter tool, your invoicing software, and your CRM, and you quietly exceed it, at which point the whole record stops working.
DKIM is a cryptographic signature. Your mail server signs each message with a private key, publishes the matching public key in DNS, and the receiver verifies that the message was not altered and did come from an authorized system. In Microsoft 365 this is off by default on custom domains, which surprises people. You have to enable it in the Defender portal and add two CNAME records.
DMARC ties the first two together and tells receivers what to do when a message fails. It is a TXT record at _dmarc.yourdomain.com, and the minimum useful version is v=DMARC1; p=none; rua=mailto:you@yourdomain.com. That says “do not reject anything yet, but send me reports about what is claiming to be me.”
Start at p=none and read the reports for a few weeks. Once you are certain every legitimate sender passes, move to p=quarantine, then eventually p=reject. Jumping straight to reject is how businesses discover that their appointment reminder system was never authorized, one week after their customers stop getting reminders.
Why this got stricter
In February 2024 Google and Yahoo changed the rules for anyone sending significant volume to their users. SPF and DKIM both have to pass, DMARC has to exist, bulk senders need one-click unsubscribe, and spam complaint rates have to stay under 0.3 percent.
The threshold for “bulk” is 5,000 messages a day, so a plumbing company is not directly covered. The reason it matters anyway is that the filters got tuned around those signals for everyone. Mail that fails authentication is now treated with suspicion at any volume.
The mistake almost every contact form makes
This one is worth its own section, because it is the single most common cause of a small business losing inquiries.
Your website form collects a name, an email address, and a message, then emails it to you. Whoever built it set the From address to the customer’s address, so that hitting reply just works.
That message now claims to come from customer@gmail.com, sent by a server Gmail has never authorized to send as gmail.com. It fails SPF. It fails DMARC. Gmail publishes a reject policy, so a strict receiver is entitled to bin it outright. Your own mail host may accept it and file it as spam, which is why these forms usually seem to half work.
The fix is small and permanent. Send the message From an address on your own domain, something like notifications@yourdomain.com, and put the customer’s address in Reply-To. Reply still goes to the customer. Authentication now passes, because you are only ever claiming to be yourself.
If you send this kind of transactional mail through a service, verify a subdomain with it rather than your main domain. Using notifications.yourdomain.com keeps the DNS for your primary mail untouched, so a mistake in the sending service cannot take down the mailbox your business runs on.
How to check yours in ten minutes
Read a real message header. In Gmail, open a message you sent to yourself from another account, click the three dots, and choose “Show original.” You want three lines at the top saying SPF: PASS, DKIM: PASS, DMARC: PASS. Anything else is your answer.
Look up your records. A free tool like MXToolbox will show your SPF, DKIM, and DMARC records and flag a duplicate SPF or too many lookups. It takes about a minute per domain.
Count your senders. Write down everything that sends mail as you: your mail host, your newsletter tool, your booking system, your invoicing software, your website form, your point of sale. Each one needs to be authorized. The list is always longer than people expect, and the forgotten entry is usually the one causing trouble.
The things that are not DNS
Authentication gets you delivered. It does not get you into the inbox on its own.
Reputation follows the domain. New domains have no history and are treated cautiously for the first few weeks. If you have just moved, expect a slow start, and do not celebrate by sending your first message to two thousand people.
Complaints matter more than anything else you control. One person marking you as spam costs you more than a hundred opens gain. Never add someone to a list because they gave you a card. Make unsubscribing one click.
Send to people who actually want it. Old lists, purchased lists, and addresses scraped from a directory produce bounces and complaints, and both are read as evidence that you are a spammer.
Content matters less than folklore suggests. The word “free” will not sink you. A message that is one giant image with a link, sent from an unauthenticated server to a stale list, absolutely will.
Watch your bounce rate. Above about 2 percent, something is wrong with the list rather than the message.
If you are on Microsoft 365
Three specifics worth knowing.
DKIM is not on by default for your custom domain. Turn it on in the Defender portal under email authentication settings.
Your SPF include is spf.protection.outlook.com, and it needs to be the only SPF record on the domain.
Shared sending infrastructure means your outbound reputation is partly the behavior of other tenants. That is normal and not worth worrying about, but it is why a perfectly configured domain can still see the occasional delay.
What to do this week
Check the three records. Fix the contact form so it sends from your own domain with the customer in Reply-To. Publish a DMARC record at p=none and actually read the reports.
That is most of the problem, it is a couple of hours once, and it does not need paying for monthly.
