Why Your Firm’s Emails Are Landing in Spam

You send a proposal to a client, you wait, and then they tell you it was sitting in their spam folder the whole time. It is a quiet problem that costs you work. And the fix is often a one-time setup.

Your important email, the one that wins work, was sitting in a junk folder. Or worse, it bounced and you never knew. That is lost work you cannot even see happening.

Here is the short version. A common reason your firm’s emails land in spam is that your domain is missing three behind-the-scenes records that prove your email is really from you: SPF, DKIM, and DMARC. Without them, email filters have a harder time trusting your messages. Setting up these three records is a one-time fix that gets your real emails delivered and stops scammers from faking your address.

Why good email lands in the junk folder

You are not a spammer. You are sending a normal proposal to a normal client. So why does Gmail treat you like junk mail? Email was built decades ago with almost no way to prove who really sent a message. Anyone can put your name and address on an email, the same way anyone can write any return address on a paper envelope. Spammers and scammers abuse this constantly.

So email providers got strict. Gmail, Yahoo, and others now look for proof that an email is really from the domain it claims to come from. If your firm has not set up that proof, your real email looks exactly like a fake one. The filter cannot tell the difference, so it plays it safe and drops you in spam.

It is not that your email is bad. It is that you never showed your ID at the door.

The three records that prove it is really you

The proof comes in three parts. All three live in your domain’s DNS settings, the internet’s address book for your domain. Here is each one in plain English.

• SPF is a list of who is allowed to send email using your firm’s name. You tell the internet which mail servers are authorized. Anything else claiming to be you looks fake.
• DKIM is a tamper-proof seal. Each email you send gets a hidden digital stamp that proves the message really came from you and was not changed along the way.
• DMARC is the instruction sheet. It tells receiving email systems what to do when a message claiming to be from you fails the first two checks: let it through, send it to spam, or reject it outright. It can also send you reports on who is sending email in your name, if the record asks for them.

Together, SPF, DKIM, and DMARC are how your firm proves its identity to the rest of the email world. Set them up and your real email gets trusted. Skip them and you look like a stranger.

The rules got stricter

This used to be a “nice to have.” In February 2024, Gmail and Yahoo set new rules for mail sent to personal Gmail and Yahoo addresses. Every sender now needs at least SPF or DKIM. Bulk senders, those sending over 5,000 messages a day, need all three. In November 2025, Gmail started enforcing harder, and mail that fails can now be rejected outright, not just filtered to spam. Microsoft added similar rules for bulk mail to Outlook.com addresses in May 2025.

Your firm is probably not a bulk sender. But filters now trust authenticated mail more and the rest less. And all three records are the best practice for stopping people from faking your address. So we recommend all three for every firm, no matter its size.

How to tell if this is your problem

A few signs point right at missing email records. Clients and consultants say they never got your email, or they keep finding your messages in spam. Your emails to Gmail and Yahoo addresses seem to vanish. You get bounce-backs saying the message was rejected. Or someone tells you they got a weird email “from you” that you never sent. That can mean scammers are already spoofing your address because nothing is stopping them. If any of that sounds familiar, the fix below is a good place to start. Authentication is not the only cause, though. Big attachments, lots of links, a hacked mailbox sending spam, or a client’s own quarantine can do it too.

The fix: set up all three, the right way

This is a one-time setup. The work happens in your domain’s DNS settings. You add an SPF record listing who can send for you, turn on DKIM so your mail gets the tamper-proof seal, and add a DMARC record telling receivers what to do with fakes. If your firm uses Microsoft 365 or Google Workspace, both have supported ways to set all three up. One catch: Microsoft says it does not DKIM sign mail from your own domain until someone sets it up. Google Workspace needs DKIM turned on too.

A few honest cautions. SPF has to list every service that legitimately sends email as your firm. That means your main email, plus things like your proposal software, newsletter tool, or accounting system. Miss one and that service’s mail can start failing. List too many and SPF can break, because Microsoft notes a record that needs more than 10 lookups fails outright. And DMARC should be rolled out in stages, starting in a “just watch and report” mode, so you can confirm your real email passes before you tell the world to reject anything that fails. Done carelessly, a DMARC record can block your own email. Done right, it protects you.

This is the kind of setup that is simple for someone who does it often and fiddly for someone doing it once. It is worth getting right, because a mistake here can stop your email instead of fixing it.

The bonus: this also stops people faking your firm

These same records do not just get your real email delivered. They also stop scammers from sending fake emails in your name. If a scammer sends your client a fake invoice from your exact email domain, DMARC set to reject checks the message, sees it is not really from you, and blocks it. Without DMARC, that fake is much more likely to get through wearing your name. But know the limit. DMARC does nothing about a lookalike domain one letter off from yours, or about a real mailbox that got hacked. Those are common ways payment scams arrive.

So this is both a delivery fix and a security win. It protects your reputation and blocks fakes sent from your exact domain. For the scams DMARC cannot stop, see our post on wire fraud in construction and our post on the phishing emails targeting architecture and engineering firms. One setup, two real benefits.

Frequently asked questions

We will get your email delivered (and trusted)

Email that lands in spam is lost work you never see, and a domain that anyone can fake is a security hole. Both are fixed by the same one-time setup, done correctly. Our managed IT services help small architecture and engineering firms get SPF, DKIM, and DMARC in place the right way, so your proposals reach clients and scammers cannot wear your name. Based in East Tennessee. Serving firms nationwide.

If your emails keep landing in junk, or you just want to make sure they will not, give us a call for a free IT checkup. We will check your domain, set up the records correctly, and confirm your real email gets through.

Sources: Email sender guidelines (Google); Email sender guidelines FAQ (Google); Sender best practices (Yahoo); Set up DKIM for your domain (Microsoft); Set up SPF for your domain (Microsoft); Outlook rules for high volume senders (Petri).