Why your business emails go to junk

What a spam filter is asking

When your email arrives at Gmail, Outlook or a business's Microsoft 365 inbox, the receiving system asks a few questions before it decides where to put it. Is this email really from the domain it claims to be from? Has this sender behaved well before, and do people who get mail like this tend to want it? Does the server it came through have a clean record? You can't see its answers, but you can check most of what feeds into them.

Google and Yahoo started enforcing sender requirements in February 2024, and Microsoft followed for Outlook.com in May 2025. The strictest parts are aimed at people sending thousands of emails a day, but the basic checks apply to everyone and they're the first place to look if your quotes and introductions keep going missing.

SPF, DKIM and DMARC in plain words

These are three short text records that sit with your domain name (the part of your address after the @). They live wherever your domain's DNS is managed, which is usually your domain registrar, your web host or your email provider. None of them changes how your email looks, because all they do is let the receiving end check that it's genuine.

Microsoft describes these as building blocks that work together, and its documentation shows that mail from a domain with none of them can fail the combined check it runs on incoming email. It also says that authenticating your email means Microsoft won't automatically junk it simply because it isn't authenticated. That's worth knowing when you write to other businesses, because the one you're writing to may well have its email on Microsoft 365.

How to see if you have them

The easiest check needs no technical tools. Send an email from your business address to a personal Gmail address (yours or a family member's), open it in Gmail on a computer and click the small arrow under the sender's name. Google says that if you see "mailed-by" and "signed-by" with your domain, the message is authenticated, and a question mark next to the sender's name means it isn't.

For the full detail, click More next to Reply and choose Show original. Look for the line that starts with Authentication-Results, where you want to see spf=pass and dkim=pass (and dmarc=pass once you've set DMARC up). In Outlook on a desktop, the same headers are under File, then Properties, in the box marked Internet headers.

If something is missing, who fixes it depends on where your email lives. Google Workspace and Microsoft 365 both publish setup steps for each record, and if your email came bundled with your web hosting, ask the host to set up SPF and DKIM for you. DMARC is one more text record, added at _dmarc followed by your domain name. Google suggests starting with a policy of p=none, which asks for reports without blocking anything, and allowing 48 hours after SPF and DKIM are in place before you add it.

One common trap is a second service that sends email as you, such as your invoicing or booking system. Microsoft's advice is to include every service that sends for your domain in your SPF record, or those emails fail the checks your everyday email passes.

What Google, Yahoo and Microsoft ask for

All three big consumer mail providers now publish rules for anyone sending to their users. They're written for personal accounts (Gmail, Yahoo and AOL, and Outlook.com, Hotmail and Live addresses) rather than business inboxes, but plenty of sole traders and small businesses use those addresses for work.

A few details are worth knowing. Google counts the 5,000 across your main domain and its subdomains together, and once you've crossed it you're treated as a bulk sender permanently. Google also says it has been ramping up enforcement since November 2025, with non-compliant mail facing temporary or permanent rejection. Microsoft says mail from high-volume domains that fails its checks goes to junk first and may be rejected if the problem isn't fixed.

If you send a few emails a day by hand you're nowhere near the bulk thresholds, but the every-sender rules still apply at Gmail and Yahoo. With a major email provider the server side (reverse DNS, the secure connection and message format) is normally handled for you, which leaves SPF and DKIM as the part to check yourself.

A new domain or mailbox sending too much too soon

Filters judge a sender partly on its history, and a domain you registered last month has none. Google's advice is to start with a low volume to people who want your mail and build up slowly, and to avoid sudden spikes if you don't have a history of sending large volumes. If emails start bouncing or being deferred, it says to cut back until the errors drop and then build up again.

For a small business the practical version is simple. Use a new address for normal day-to-day email first, with suppliers and customers who'll write back, and add new contacts a few a day rather than in one big batch. The same goes for an old domain that has sat quiet for years, because a mailbox that suddenly sends far more than it ever has is a spike whatever its age.

Links, attachments and images

Google asks that links be visible and easy to understand, and warns that using code or styling to hide content can trigger spam filtering. A shortened link hides where it goes, which is the opposite of what Google is asking for, so link to your own website in full or not at all.

Gmail won't let you attach some file types at all, including programs and scripts such as .exe and .js files and password-protected archives, and it can block messages whose content or links might spread viruses. A PDF quote to an existing customer is normal. A PDF from a stranger in a first email is harder to trust for the filter and for the person, so offer to send it once they reply.

Images work the same way. An email with a banner, several pictures and very little text looks like marketing because it is, while a plain email with a text signature looks like a person wrote it.

People marking you as spam

Google and Yahoo both set the limit for spam complaints at 0.3% of mail, and Google advises keeping it below 0.1%, which is one complaint in every thousand emails. If you only send a few dozen, a single person pressing "report spam" is a far bigger share than that.

People report email that feels irrelevant, impersonal or impossible to get out of. Write only to businesses with a real reason to hear from you, at the address they publish themselves, and give them an easy way to say no in every email. Microsoft's advice to large senders makes the same points: accurate subject lines, no deceptive headers, a From address that can receive replies, a clear way to opt out and recipients who have consented. Consent and an unsubscribe are also legal requirements in Australia (see whether cold emailing is legal in Australia), and the guide on writing a first email to a business shows all of this in practice.

A shared or blocklisted sending address

Your email leaves through a server with its own internet (IP) address, and if you use budget hosting or the email that came with your website, you're probably sharing that address with other customers. Google points out that everyone on a shared address affects its reputation, so another customer's spam can drag your mail down too, and it recommends making sure the shared address isn't on an internet blocklist.

Spamhaus is one of the best-known blocklist operators and it runs a free reputation checker at check.spamhaus.org. You'll find your sending IP in the Show original headers of one of your own emails in the Received lines. If your provider's server is listed it's theirs to fix, and if that keeps happening it's worth moving your email somewhere larger. If you see bounces or complaints you can't explain, check whether your mailbox has been broken into and is sending spam behind your back, then change the password and turn on two-step sign-in.