You sent an invoice three weeks ago. The client hasn’t paid. You send a polite follow-up, but hear nothing. You call them. “Oh, I never received it,” they say. “Can you resend it?”
You didn’t make a billing error or forget the attachment. Your email was delivered, but it landed in their spam folder. They never saw it.
This happens to small businesses every day. Invoices, quotes, and contracts sit in spam folders. Owners wonder why clients aren’t responding. Usually, the issue isn’t what you wrote: it’s your domain’s technical setup. You need to configure DMARC.
Why Your Business Emails Land in Spam
Email providers like Gmail, Outlook, and Yahoo run every incoming message through authentication checks. These checks answer one question: is this email actually from who it says it is from?
If your domain cannot prove that an email was sent by an authorised sender, the receiving server treats it as suspicious. It might deliver it to spam. It might flag it with a warning. In some cases, it rejects it outright and you never know it was blocked.
Three protocols handle this authentication. They work together, and all three need to be configured on your domain:
SPF (Sender Policy Framework) tells receiving servers which mail servers are allowed to send emails on behalf of your domain. If your domain is yourbusiness.com.au, SPF says “only these specific servers can send email as @yourbusiness.com.au.” If an email comes from a server not on that list, it fails the check.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to every outgoing email. The receiving server checks this signature against a public key published on your domain. If the signature matches, the email has not been tampered with in transit. If it does not match, or there is no signature at all, the email fails.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do when an email fails one or both checks. Without DMARC, each email provider decides on its own. With DMARC, you control the outcome: deliver it, quarantine it, or reject it.
When all three are set up properly, your emails arrive in the inbox. When they are not, your domain looks like a potential source of spam or phishing. That is why your invoices are disappearing.
Email Authentication Is a Baseline Requirement in 2025
Email authentication is no longer optional. Major providers like Google, Yahoo, and Microsoft now enforce strict authentication standards for all incoming mail. If your domain does not meet these requirements, your emails are at a disadvantage before they even reach the recipient’s server. This is not a future change to prepare for. It is the current reality your domain needs to meet today.
Here is what every business domain must have in place right now:
- Valid SPF and DKIM records published on your domain
- A DMARC policy in place (ideally set to quarantine or reject)
- Proper alignment between your sending services and your authentication records
If your business sends email from a custom domain (anything other than @gmail.com or @outlook.com) and you still have not configured these records, you are already losing emails. Spam filters are stricter than ever, delivery rates continue to tighten, and you will not get a bounce-back notification when a message is quietly blocked. The longer you wait, the more invoices, quotes, and client communications disappear without a trace.
How to Check If Your Domain Is Configured Properly
Check your current status first. It takes less than five minutes.
Use a Free DMARC Checker
Go to MXToolbox or dmarcian’s Domain Checker. Type in your domain name. The tool will scan your DNS records and report whether SPF, DKIM, and DMARC are configured.
You will get one of three results:
- All three present and valid. You’re all set. Keep an eye on it using the monitoring steps below.
- Some missing or misconfigured. Common. Most small businesses have SPF but are missing DKIM or DMARC. Follow the setup steps below.
- Nothing configured. Your emails are at high risk of landing in spam. Fix this today.
Check Your Recent Email Delivery
Send a test email from your business address to a personal Gmail account. Check if it arrives in the inbox or spam. Open the email, click the three dots, and select “Show original.” Look for the authentication results:
spf=passmeans SPF is workingdkim=passmeans DKIM is workingdmarc=passmeans DMARC is working
If any of these show fail or none, that is your problem. Your invoices are not bouncing. They are being quietly buried.
How to Set Up SPF, DKIM, and DMARC
You need access to your domain’s DNS settings (usually through your domain registrar or hosting provider) and about 30 minutes.
Setting Up SPF
SPF is a single TXT record added to your domain’s DNS. It lists every service that sends email on your behalf.
If you use Google Workspace, your SPF record looks like this:
v=spf1 include:_spf.google.com ~all
If you send emails through an invoicing platform like Xero or a CRM like HubSpot, you need to include their servers too:
v=spf1 include:_spf.google.com include:spf.xero.com ~all
Check each email-sending tool you use for their SPF include statement. Add them all to one SPF record. Do not create multiple SPF records. One record, multiple includes.
Setting Up DKIM
DKIM requires generating a key pair through your email provider and adding the public key to your DNS as a TXT record.
In Google Workspace: Admin Console > Apps > Google Workspace > Gmail > Authenticate Email. Google gives you the TXT record to add. Copy it, paste it into your DNS settings under the host name Google specifies, and save.
Other platforms (Microsoft 365, Zoho, etc.) have similar processes. Search “[your email provider] DKIM setup” for the exact steps.
Setting Up DMARC
DMARC is another TXT record. Start with a monitoring-only policy:
v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com.au
This allows you to monitor failures without accidentally blocking legitimate mail.
Add this record to your DNS with the host name _dmarc. So for yourbusiness.com.au, the full record is:
- Host:
_dmarc.yourbusiness.com.au - Type: TXT
- Value:
v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com.au
After two to four weeks of collecting reports (use a free tool like DMARC Analyzer or dmarcian to read them), tighten the policy:
p=quarantinesends failing emails to spam instead of inboxp=rejectblocks them entirely
Move to quarantine first. Run it for a month. If nothing legitimate is being caught, move to reject. That’s the most secure setup.
Ongoing Maintenance
Treat email authentication as part of your regular maintenance. Every time you add a new tool that sends email from your domain (a new CRM, a booking system, a newsletter platform), you need to update your SPF record and set up DKIM for that tool.
Set a quarterly reminder to:
- Run your domain through MXToolbox again
- Check that new sending services have been added to SPF
- Review DMARC reports for any failures you did not expect
If you switch email providers or change your domain registrar, recheck everything. DNS records do not always migrate cleanly.
Frequently Asked Questions
What is DMARC?
DMARC is a setting on your domain that tells email providers how to handle messages that fail authentication checks. It stops hackers from spoofing your domain and ensures your real emails actually arrive.
Will setting up DMARC stop all my emails from going to spam?
It fixes authentication-related spam issues, which are the most common cause for business emails. If your email content triggers spam filters (excessive links, spammy language, large attachments), you will need to address that separately.
Do I need a technical person to set up SPF, DKIM, and DMARC?
You need access to your DNS settings and 30 minutes. Most email providers have step-by-step guides. If you are uncomfortable editing DNS records, your technology partner or domain registrar can do it for you in a single session.
How do I know if my emails are currently going to spam?
Send a test email to a personal Gmail and Outlook account. If it lands in spam or the Promotions tab, check the email headers for SPF, DKIM, and DMARC pass/fail results. Free tools like MXToolbox test delivery without needing a test account.
Fix This Before You Send Another Invoice
A 30-minute fix is all it takes to stop losing money to a spam filter. SPF, DKIM, and DMARC take 30 minutes to set up. Once configured, your invoices arrive, your quotes get read, and your business emails carry the trust they should have had all along. Check your cyber profile to see where your email security and domain health stand right now.
