Why Your Emails Land in Spam or Get Spoofed, and How to Fix It Safely
Why your business email lands in spam or gets spoofed, what SPF, DKIM and DMARC actually do, and how to tighten them in phases without breaking your mail.
Emails usually land in spam, or get spoofed, because the domain isn't properly set up to prove which senders are allowed to use it. Three settings handle this: SPF, DKIM and DMARC. Changing them carelessly can block your own legitimate mail, so the safe approach is to find every service that sends as you, monitor first, then tighten in steps.
Why are my emails going to spam?
When your email arrives at a client's inbox, their mail system asks a simple question: is this really from you? If your domain can't answer clearly, the message looks suspicious. It might be filtered to spam, delayed or rejected outright.
Common causes include:
- Your domain's email authentication settings are missing, incomplete or out of date.
- A service that sends on your behalf, like a billing tool or CRM, was never added to those settings.
- Your domain or sending server ended up on a blocklist, often after a compromised account sent spam.
- A change to your email filter or provider altered how outgoing mail is routed.
- The content or volume of a message looks like bulk marketing.
The first two are the most common for small businesses, and the most fixable.
Why can someone send email pretending to be us?
Email was designed decades ago without any built-in proof of who sent a message. Anyone can type your address into the "from" line. That's called spoofing.
Spoofed messages are a favorite tool for fake invoices and payment-change requests, because they look like they came from you or your leadership. Authentication settings let receiving mail systems spot and reject those fakes.
What are SPF, DKIM and DMARC in plain language?
All three live in your domain's DNS, which is the public directory that tells the internet where your website and email are hosted. Each one proves something different.
| Setting | What it proves | Plain-language version |
|---|---|---|
| SPF (Sender Policy Framework) | Which servers are allowed to send mail for your domain | A guest list of approved senders |
| DKIM (DomainKeys Identified Mail) | That the message was signed by your domain and not altered in transit | A tamper-evident seal on each envelope |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | What receivers should do when a message fails the checks, and where to send reports | Instructions to the front desk, plus a daily log of who tried to get in |
SPF and DKIM do the checking. DMARC ties them together and tells the world how strict to be. DMARC also sends you reports, which is how you discover senders you didn't know about.
DMARC adds one more test that trips people up: the domain a service vouches for has to match the domain in the From line. A billing tool can pass its own checks and still fail DMARC if it's signing with its own domain instead of yours. That's why each service needs to be set up to send as your domain specifically.
Why can changing these settings break our email?
This is the part that worries people, and for good reason. If you tell the world "reject anything not on our guest list" before the guest list is complete, your own legitimate mail starts bouncing.
The senders that get forgotten are almost never your main mailbox. They're the quiet systems that send as your domain in the background:
- Accounting and invoicing tools that email invoices and receipts
- Your CRM or sales outreach platform
- Email marketing and newsletter services
- Website contact forms and booking tools
- Payroll, HR and e-signature services
- Help desk or customer support platforms
- Scanners, copiers and other office equipment that send email
Any one of these can stop delivering if it's left out. Often nobody notices until a client says they never got an invoice.
How do you fix email authentication safely?
We use a phased approach. It takes a little longer, and it avoids the outage everyone fears.
- Inventory your senders. List every service that sends email as your domain. Ask finance, sales, marketing and operations, because each team tends to have its own tools.
- Check what's already in place. Look at existing SPF, DKIM and DMARC records. It's common to find duplicates, old services that should be removed or settings that conflict. Your domain can have only one SPF record, and that record can only reference a limited number of services, so a long list of add-ons can quietly break it.
- Set up SPF and DKIM for each legitimate sender. Most services publish instructions for this. DKIM in particular often needs to be turned on inside each tool, not just in DNS. For high-volume marketing email, many businesses use a separate subdomain, such as news.yourcompany.com, so a marketing problem doesn't affect everyday mail.
- Turn on DMARC in monitoring mode. At this stage DMARC only reports. It doesn't block anything. Reports show which systems are sending as you and whether they pass.
- Review the reports for a few weeks. Fix anything legitimate that's failing. Investigate anything you don't recognize.
- Tighten gradually. Move from monitoring to sending failures to spam, then to rejecting them, checking reports at each step.
- Lock down domains you don't email from. Extra domains you own but never send from can be set to reject all mail right away, so nobody can spoof them.
- Keep watching. Every new tool your team adopts that sends email needs to be added. This is ongoing upkeep, not a one-time project.
DNS and email authentication changes can affect delivery for your whole company. Validate and test each change, ideally starting in monitoring mode, before enforcing it. Make one change at a time so you can tell what caused any problem.
What if we're on a blocklist?
A blocklist is a list that some mail systems use to filter senders with a history of spam. Getting on one usually means something sent spam from your domain or mail server, often a compromised account.
The order matters here. First find and fix the cause, such as resetting a compromised account, turning on multi-factor sign-in (MFA) and checking for unusual forwarding rules. Then request removal from the list. Asking to be removed before the cause is fixed usually means you end up back on it.
How long does it take?
Finding senders and setting up SPF and DKIM can move quickly. The monitoring period is the part worth not rushing, because it's what keeps the final step from breaking anything. How long that takes depends on how many tools send mail as your domain and how quickly each one gets configured.
Email authentication is one piece of a wider set of protections. For the rest, see the security basics every 25-person company needs.
Where to start
If your mail is landing in spam or someone is spoofing your domain, a quick review of your current settings usually shows where the gaps are. Our cybersecurity service includes this kind of ongoing upkeep. Book a 15-minute call and we'll talk through what you're seeing and the safest first step.
Last reviewed November 3, 2026. This article is general information, not legal, insurance or compliance advice, and reading it doesn't make you a Simple IT client. Have your IT provider confirm any steps for your setup, and talk with your attorney, insurance broker or auditor about how anything here applies to your business. See our Terms of Use.