Why your business emails are going to spam

Start with a 60-second check

Type your domain into the box above. Harbour looks up the public settings on your domain and gives you a grade from A to F, with a short list of what to fix. It reads only; nothing on your domain changes.

If the grade is C or lower, the settings below are very likely part of the reason your email is landing in junk.

The three settings inbox providers now require

Google and Yahoo tightened their rules in 2024, and Microsoft followed in 2025. Businesses that send email are expected to have three things set up on their domain:

• SPF: a list of the services allowed to send email for your domain, such as Microsoft 365, Google Workspace or your invoicing tool. Check your SPF.
• DKIM: a digital signature added to each email, so the receiver can tell it wasn't altered and really came from a service you approved. Check your DKIM.
• DMARC: a short instruction that tells inboxes what to do with email that fails those checks, and asks them to send you reports. Check your DMARC.

When one of these is missing or wrong, receivers have less reason to trust your mail. Some of it goes to junk, and some is turned away altogether.

Other common causes

If your three settings are in good shape and mail still goes to spam, look at these:

• A tool sending as you that isn't set up. Newsletters, CRMs, booking systems and helpdesks often send "from" your domain. Each one needs adding to SPF and, ideally, signing with DKIM.
• Shared sending servers. Cheap or free mailing services share servers between many customers. If a neighbour sends spam, your mail can suffer.
• Content and links. Link shorteners, image-only emails and attachments people didn't expect all count against you.
• Your list. Sending to old or bought addresses causes bounces and spam complaints, which damage your reputation quickly.

How to fix it, step by step

1. Run the check above and note which of SPF, DKIM and DMARC need attention.
2. List every service that sends email as you. Your mailbox provider, plus anything that sends invoices, newsletters, receipts or reminders.
3. Fix SPF so that it includes each of those services, as one single record. Our SPF checker counts lookups for you.
4. Switch on DKIM in each service's settings. It's usually a button plus one or two DNS records to copy.
5. Add a DMARC record. Start in watch mode (p=none). The DMARC record generator writes it for you.
6. Tighten over a few weeks to p=quarantine and then p=reject, once every real sender passes. See getting to p=reject safely.

Keep it fixed with monitoring

Email setups change all the time: a new marketing tool, a move to a new DNS host, a colleague editing a record. Each change can quietly push mail back into spam.

Once DMARC is in place, inbox providers send daily reports about every email sent using your domain. Harbour reads them for you and sends a plain-English alert when something fails, with the exact fix to pass on to whoever looks after your website.