Why Are My Business Emails Going to Spam? A Utah Small Business Guide

A homeowner in Roy asks for a quote on Monday. You write it up that afternoon and email it over. By Friday you haven't heard back, so you call. "I never got anything," they say. Then they check their spam folder, and there it's, sitting next to the junk mail. By then they may have already hired someone else.

If your business emails are going to spam, you're not alone, and it usually isn't because of anything you wrote. Most of the time it comes down to a few settings on your domain that tell Gmail, Yahoo, and Outlook your email is really from you. This guide explains why it happens, what the big email providers now require, how to check your own setup in a few minutes, and how to fix it step by step.

Why Business Emails End Up in Spam

Email providers decide where each message goes by asking two questions: can we prove this email really came from the business it says it's from, and do people want to get it? When the answer to either one is unclear, the message is more likely to land in spam or be rejected. The most common reasons for a small business are:

• Missing email authentication. Your domain doesn't have SPF, DKIM, or DMARC records set up, or they're set up wrong.
• Tools that send "as you" but aren't authorized. Your website contact form, CRM, invoicing software, booking system, or review request tool sends email using your address, but your domain's records don't list it.
• Sending from a free address through another tool. Using a @gmail.com address as the "From" address in a CRM or email tool that isn't Gmail.
• Spam complaints. People who didn't expect your email mark it as spam, which hurts future delivery for everyone on your list.
• Old or purchased lists. Emailing addresses that bounce, or people who never signed up.
• Misleading details. Subject lines that start with "Re:" when the email isn't a reply, or display names that look like a subject line instead of your business name.

The good news: the first three are technical settings you fix once, and the rest are habits.

What Gmail, Yahoo, and Outlook Now Require

Starting in 2024, the biggest email providers began enforcing clear rules for anyone sending to their users.

Gmail. Starting February 1, 2024, Google requires everyone who sends to personal Gmail accounts to set up SPF or DKIM for their sending domain, have valid forward and reverse DNS for their sending servers, use a secure (TLS) connection, and keep spam rates reported in Google Postmaster Tools below 0.3%. Senders of more than 5,000 messages a day to Gmail accounts must also set up SPF, DKIM, and DMARC, make sure the From address lines up with SPF or DKIM, and offer one-click unsubscribe on marketing messages. Google also recommends setting up all three for every domain, and says unauthenticated messages "might be marked as spam or rejected." (Gmail Help: Email sender guidelines)

Google counts all messages from the same main domain toward that 5,000 number, and a sender that hits it even once is permanently treated as a bulk sender. Google also says that starting November 2025 it's ramping up enforcement, and messages that don't meet its sender requirements "will experience disruptions, including temporary and permanent rejections." (Gmail Help: Email sender guidelines FAQ)

Yahoo. Yahoo's rules started in February 2024 and look much the same. All senders need SPF or DKIM at a minimum, a spam rate below 0.3%, and valid forward and reverse DNS. Bulk senders need SPF and DKIM, a DMARC policy of at least p=none, one-click unsubscribe, and must honor unsubscribes within 2 days. Yahoo also "strongly urges all senders to publish a DMARC policy." (Yahoo Sender Hub: Sender Best Practices)

Outlook.com. Microsoft announced in April 2025 that domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com, and Live.com addresses must pass SPF and DKIM and have DMARC set to at least p=none. Microsoft first said those messages would go to the Junk folder, then updated its announcement to say they'll be rejected. For smaller senders, Microsoft's own answer is that "all senders benefit from these best practices." (Microsoft Tech Community: Outlook's New Requirements for High-Volume Senders)

Most Utah small businesses send far fewer than 5,000 emails a day. But the basic rules apply to everyone, and the providers recommend the full setup for everyone. Setting up all three records is the simplest way to stay on the safe side as the rules keep tightening.

SPF, DKIM, and DMARC in Plain English

These three records live in your domain's DNS settings, usually wherever you bought your domain or where your website's DNS is managed. You don't have to understand the technical details, but it helps to know what each one does.

SPF: the list of who's allowed to send

SPF (Sender Policy Framework) is a single line of text on your domain that lists every service allowed to send email as your business. Google's example for a business that only sends through Google Workspace is v=spf1 include:_spf.google.com ~all. If you also send from other tools, each one gets added to the same line. Google notes that the SPF record "should include all email senders for your domain," and that senders left off the list are more likely to land in spam. (Google Workspace Help: Set up SPF)

DKIM: a digital signature on every email

DKIM (DomainKeys Identified Mail) adds a hidden signature to each email your business sends, and a matching key goes in your DNS. Receiving servers use it to verify that the domain owner actually sent the message and that it wasn't changed along the way. You turn DKIM on inside each service that sends your email, then add the record it gives you. Google requires a key of at least 1024 bits for mail to personal Gmail accounts and recommends 2048 bits where your provider supports it. (Gmail Help: Email sender guidelines)

DMARC: your instructions for fake email

DMARC tells receiving servers what to do when an email claims to be from your domain but doesn't pass SPF or DKIM: deliver it, send it to spam, or reject it. It can also send you reports so you can see who is sending email using your domain. To pass DMARC, an email has to pass SPF or DKIM, and the domain that passed has to match the domain in the From address. Google recommends starting with a policy of "none" while you learn how your email is being handled. A starting record looks like this, using your own domain and a mailbox you set aside for reports: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com (Google Workspace Help: Set up DMARC)

How to Check Your Email Setup in 10 Minutes

Before you change anything, find out where you stand.

1. Send yourself a test. From your business email, send a normal message to a personal Gmail address.
2. Open the full header. In Gmail on a computer, open the message, click the three-dot More menu next to Reply, and choose Show original. (Gmail Help: Trace an email with its full header)
3. Look for three passes. The page shows whether the message passed SPF, DKIM, and DMARC. You want to see PASS for all three.
4. Repeat for every tool that sends as you. Submit your own website contact form, send yourself an invoice, book a test appointment, and send a test from your CRM. Check each one the same way. This is where most problems show up.
5. Check your domain's records. Google's free Admin Toolbox Check MX tool looks up your domain's email settings and flags common problems.

How to Fix It, Step by Step

Step 1: List every service that sends email as your business

Google's list of places to look includes web servers, your email provider, services that send automatic email like "Contact us" forms, and any third-party service that sends email for your domain. (Google Workspace Help: Set up SPF) For a typical Utah service business, that list might include:

• Your main email (Google Workspace, Microsoft 365, or your domain host's email)
• Your website's contact form notifications
• Your CRM, which may send follow-ups, appointment reminders, and newsletters
• Invoicing and payment software
• Online booking or scheduling tools
• Review request tools

Step 2: Build one SPF record that includes all of them

Each service's help pages will tell you what to add to your SPF record. Combine them all into a single SPF line. Don't create a second SPF record for a new tool; the SPF standard says that when a domain has more than one SPF record, the check returns an error. The same standard limits SPF to 10 DNS lookups, so a record stuffed with too many services can fail too. (RFC 7208: Sender Policy Framework) If your list is getting long, remove services you no longer use.

Step 3: Turn on DKIM in each service

Most email providers, CRMs, and email tools have a domain authentication or DKIM setting. Turn it on and add the DNS records they give you. If a tool can't sign email with your domain, ask its support team how they authenticate email sent with your address.

Step 4: Add a DMARC record, starting at "none"

Google recommends waiting until SPF and DKIM have been working for at least 48 hours before you turn on DMARC. Start with p=none and a reporting address, so nothing gets blocked while you confirm every service is passing. Use a separate mailbox or group for the reports, because they can add up quickly. (Google Workspace Help: Set up DMARC)

Step 5: Tighten your policy over time

Once your reports show your real email passing, you can change your policy to quarantine and later reject, which tells providers to stop fake email that pretends to be you. Microsoft calls p=reject "the most effective at thwarting domain spoofing" once your legitimate senders are aligned, and advises moving gradually from none to quarantine to reject so you don't lose real email. (Microsoft Tech Community: Outlook's New Requirements for High-Volume Senders)

Step 6: Test again, and update when you add a tool

Repeat the 10-minute check from above. Then make it a habit: whenever you start using a new tool that sends email as your business, add it to SPF and turn on its DKIM before you send anything to customers. Google's own advice is to update your SPF record when you add a new sender, and to remove senders you no longer use. (Google Workspace Help: Set up SPF)

Use an Email Address on Your Own Domain

A free @gmail.com or @yahoo.com address is fine for personal email, but it's a weak choice for a business. You can't add SPF, DKIM, or DMARC records to a domain you don't own, so you can't authenticate email that other tools send with that address. Google's sender guidelines warn senders not to impersonate Gmail From addresses, and say Gmail will use a DMARC quarantine policy for them, which can affect delivery when a tool other than Gmail sends as a @gmail.com address. (Gmail Help: Email sender guidelines)

An address like office@yourbusiness.com on the same domain as your website looks more professional, and it's the address you can actually set up correctly. Google also recommends always setting up email authentication for the domain that hosts your public website.

Sending Habits That Keep You Out of Spam

Authentication proves the email is from you. Your habits decide whether people want it. These come straight from the Gmail and Yahoo sender guidelines:

• Only email people who asked to hear from you. Customers, leads who contacted you, and people who signed up. Don't buy email lists.
• Don't pre-check the newsletter box on your website forms.
• Make unsubscribing easy on newsletters and promotions, and honor requests quickly. Yahoo says within 2 days, and Google recommends within 48 hours.
• Keep spam complaints low. Google says to keep your spam rate below 0.1% and never reach 0.3%. If you send enough email to Gmail users, you can watch this number in Google Postmaster Tools.
• Use an honest display name and subject line. Your display name should be your business or your name, not "URGENT" or "Last Chance." Don't start a subject with "Re:" or "Fwd:" unless it really is a reply or forward.
• Keep message types separate. Google suggests using the same From address for each type of message (for example, receipts from one address and promotions from another) and not mixing promotions into receipts.
• Remove addresses that bounce, and consider dropping people who haven't opened anything in a long time.
• Grow slowly. If you're about to send your first big newsletter, start with your most engaged customers and increase volume over time instead of emailing your whole contact list at once.

(Gmail Help: Email sender guidelines; Yahoo Sender Hub: Sender Best Practices)

When Your Website's Contact Form Emails Go to Spam

This one catches plenty of business owners. A customer fills out the form on your website, and the notification lands in your own spam folder, or never arrives. Google lists "Contact us" forms among the services that send email for your domain, so the service that sends those notifications needs to be covered by your SPF and DKIM like any other. (Google Workspace Help: Set up SPF) Google also advises against marking your own internal messages as spam, because that can hurt your domain's reputation.

Even better, send form leads straight into a CRM, so every lead is saved as a contact whether or not the notification email arrives. Our guide to choosing a business CRM explains how that works.

Common Mistakes to Avoid

1. Two SPF records. Adding a new SPF line for each new tool instead of combining them into one.
2. Forgetting the tools that send for you. Your main email passes, but your invoices, reminders, and form notifications don't.
3. Jumping straight to p=reject. Turning on a strict DMARC policy before every real sender passes can block your own email.
4. Sending reports to your main inbox. DMARC reports can pile up quickly. Use a separate mailbox or group.
5. Using a free email address for business. You can't authenticate a domain you don't own.
6. Emailing people who never signed up. Complaints hurt delivery for all of your email, including quotes and invoices.
7. Setting it and forgetting it. A new tool, a new website, or a change of email provider can break your setup without warning.

Your Business Email Checklist

1. Use an email address on your own domain
2. List every service that sends email as your business
3. Publish one SPF record that includes all of them
4. Turn on DKIM in each service
5. Add a DMARC record starting at p=none, with a separate mailbox for reports
6. Send test emails and confirm SPF, DKIM, and DMARC all pass
7. Test your website contact form, invoices, reminders, and CRM emails too
8. Only email people who asked, and make unsubscribing easy
9. Move DMARC to quarantine, then reject, once everything passes
10. Recheck whenever you add or change an email tool

Frequently Asked Questions

Why are my emails suddenly going to spam?

Common causes are a new tool sending email as your business without being added to your SPF and DKIM, a change to your domain or DNS settings, or a jump in spam complaints after a big send. Run the 10-minute check above to see whether SPF, DKIM, and DMARC are passing.

Do I need SPF, DKIM, and DMARC if I only send a few emails a day?

Gmail and Yahoo require all senders to have at least SPF or DKIM, and the stricter rules are aimed at senders of 5,000 or more emails a day. Google, Yahoo, and Microsoft all recommend setting up all three anyway, and it's the best protection against scammers sending fake email using your domain.

Will setting up DMARC block my email?

Not if you start with p=none, which only asks for reports and doesn't change how your email is delivered. Move to quarantine or reject only after your reports show all your real email passing.

Can I use my @gmail.com address to send emails from my CRM?

It's not a good idea. You can't add authentication records to gmail.com, and Google warns against sending as a @gmail.com address from servers other than Gmail. Use an address on your own business domain instead.

Where do I add these records?

In the DNS settings for your domain, usually at the company where you bought the domain or wherever your DNS is managed. Each email provider and tool will give you the exact values to add.

Get Your Business Email Working Right

1 Day Website Utah has helped Utah businesses since 2014 from our office in Ogden. We build fast, mobile-friendly websites and pair them with the 1 Day Website business CRM, which brings two-way texting, email, and web chat into one inbox and turns forms, chat, and calls into tracked leads. Every monthly CRM plan includes a 14-day free trial; see our plans.

Not sure whether your business email is set up correctly? Contact us, call or text (385) 999-2468, or email hello@1daywebsiteutah.com.

Sources

• Gmail Help, "Email sender guidelines": support.google.com/a/answer/81126
• Gmail Help, "Email sender guidelines FAQ": support.google.com/a/answer/14229414
• Google Workspace Help, "Set up SPF": support.google.com/a/answer/33786
• Google Workspace Help, "Set up DMARC": support.google.com/a/answer/2466580
• Gmail Help, "Trace an email with its full header": support.google.com/mail/answer/29436
• Yahoo Sender Hub, "Sender Best Practices": senders.yahooinc.com/best-practices
• Microsoft Tech Community, "Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders": techcommunity.microsoft.com
• IETF, RFC 7208, "Sender Policy Framework (SPF)": datatracker.ietf.org/doc/html/rfc7208