Our e-mails go to recipients' spam: causes and how to fix it

When customers say they found your quote or invoice in their spam folder, the cause is usually technical rather than the message itself. Large mail providers (Gmail, Outlook.com, Yahoo) check whether a message really comes from your domain. Since 2024 Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders, and in practice they are now essential for smaller senders too.

Common causes

• SPF missing or wrong. SPF is a TXT record in your domain's DNS that lists which servers may send mail on your behalf. It is often left over from a previous provider, or the domain has several SPF records (only one is allowed).
• DKIM not enabled in Microsoft 365. DKIM adds a digital signature to each message. For a custom domain it has to be activated separately.
• No DMARC. DMARC tells the recipient what to do with mail that fails SPF and DKIM checks, and sends you reports.
• Domain or IP reputation. If one of your mailboxes was hacked and sent spam, or the domain is on a blacklist, all your mail suffers.
• Bulk mail from Outlook. Sending a newsletter to hundreds of people from a normal mailbox looks like spam and can get the mailbox blocked from sending.
• Website contact forms and other systems. The website, web shop or accounting program sends mail in your domain's name but from its own server, which is not in your SPF and does not sign with DKIM.
• Content: a single large image, shortened links, lots of exclamation marks, attachments with macros.

How to check

1. Message headers. Send a message to a personal Gmail account and open "Show original" (in Outlook: open the message → File → Properties → Internet headers). Look for the Authentication-Results line: it should show spf=pass, dkim=pass and dmarc=pass.
2. A mail-tester service. Free online services give you a temporary address; you send a message there and get a score with an explanation of what is missing.
3. DNS and blacklist check. MXToolbox-style tools show your domain's SPF, DKIM and DMARC records and whether the domain or IP is on a blacklist.

Fixes, in order

1. SPF. The domain needs exactly one TXT record; for Microsoft 365 it looks like v=spf1 include:spf.protection.outlook.com -all. If other services send mail too (web hosting, newsletter tool), their include goes into the same record.
2. DKIM. Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Select your domain, add the two CNAME records shown to your DNS and enable signing.
3. DMARC. Add a TXT record named _dmarc, start with the relaxed policy v=DMARC1; p=none and use the rua parameter to name a mailbox for reports. Once the reports show all legitimate senders passing, tighten the policy to p=quarantine.
4. Other systems. Configure the website form and web shop to send with authentication (a dedicated sending service, a Microsoft 365 connector or an official integration). Note that SMTP sign-in with a plain username and password (Basic authentication) has been switched off in Exchange Online.
5. Bulk mail belongs in a separate newsletter platform with its own DKIM and an unsubscribe link.
6. Reputation. If the domain is blacklisted, find the cause (hacked account, infected PC), fix it, then request delisting.

DNS changes usually take effect within a few hours. Test again after each change.

When to call a professional

If someone else manages your DNS, several systems send mail for you, or messages still land in spam after the fixes, have a specialist review the setup – a wrong SPF or DMARC record can block your mail altogether. ITABIKS sets up domain authentication as part of Microsoft 365 administration.