Why Your Emails Land in Junk
Why Your Emails Land in Junk
Email deliverability fails quietly. Nobody tells you your message went to junk. You just get fewer replies than you expected, and there’s no obvious reason why.
For most businesses this is a background irritation. For anyone whose work depends on outbound email, sales teams, recruiters, anyone doing volume outreach, it’s a direct commercial problem that often goes undiagnosed for years.
The good news is that a large share of it comes down to three DNS records, and those are fixable.
The Underlying Problem
Email was designed in an era when the internet ran on trust. Nothing in the original protocol prevents anyone from sending a message claiming to be from your domain. That’s why phishing works.
Receiving mail providers therefore have to guess whether a message is genuine. They look at whether the sending server is authorised, whether the message has been tampered with, what your domain’s history looks like, and how recipients have reacted to your mail in the past.
Get those signals right and your mail lands. Get them wrong, or leave them unconfigured, and you’re relying on the recipient’s spam filter being generous.
The Three Records
SPF: which servers are allowed to send
SPF is a DNS record listing the servers permitted to send email for your domain. When a receiving server gets a message claiming to be from you, it checks whether the sending server appears on that list.
Where it goes wrong:
Third-party senders that were never added. This is the most common problem by a distance. Your email might come from Microsoft 365, but your invoicing software also sends as you. So does your CRM, your marketing platform, your booking system, and the form on your website. Each one added over the years, none of them added to SPF.
More than one SPF record. A domain must have exactly one. Two records is not “more coverage”, it’s an invalid configuration that fails outright. This happens when different people add records at different times.
Too many DNS lookups. SPF permits a limited number of lookups when evaluating a record, and each include: for a third-party service consumes some. Businesses using several services can exceed the limit, at which point SPF fails regardless of whether the sending server was legitimate.
Ending in ?all or nothing meaningful. The end of the record tells receivers what to do with mail from servers not on the list. A neutral setting tells them essentially nothing.
DKIM: proof the message hasn’t been altered
DKIM adds a cryptographic signature to outgoing mail. The matching public key sits in your DNS, so a receiving server can verify both that the message genuinely came from an authorised sender and that it wasn’t modified in transit.
Where it goes wrong:
It’s simply not enabled. With Microsoft 365 in particular, DKIM has historically needed switching on deliberately rather than being active by default. Plenty of tenants have never had it turned on.
Only enabled for some senders. Your main mail platform signs its messages, but the CRM and marketing tool don’t, so a portion of your mail is unsigned.
Keys not rotated. Less critical, but signing keys should be changed periodically.
DMARC: what to do when checks fail
DMARC ties the other two together. It tells receiving servers what you want done with mail that fails SPF and DKIM, and it can send you reports on what’s being sent using your domain.
There are three policy settings: monitor only, quarantine to junk, or reject outright.
Where it goes wrong:
No DMARC record at all. Increasingly a problem, as major providers have tightened requirements on senders.
Stuck on monitor mode indefinitely. Monitor mode is the correct starting point, it gathers data without affecting delivery. But it’s meant to be a phase, not a destination. Many businesses set it years ago and never progressed, so they get the reports and none of the protection.
Nobody reads the reports. DMARC aggregate reports arrive as XML and are close to unreadable raw. There are free and paid tools that turn them into something legible, and they will show you exactly which services are sending as your domain, including ones you’d forgotten about.
The alignment trap. This is the subtle one. DMARC doesn’t only require SPF or DKIM to pass, it requires the passing check to align with the domain in the visible From address. It’s entirely possible for SPF to pass while failing alignment, which means DMARC fails while everything looks superficially fine. This catches out businesses sending through third-party platforms, and it’s a common reason for “we have SPF, so why is this still happening”.
It Isn’t Only Authentication
Getting the three records right removes the most common technical obstacles. It doesn’t guarantee inbox placement, because reputation matters too.
Recipient behaviour. If people mark your mail as spam, delete it unread, or never engage, that gets noticed. If they reply and move messages out of junk, that gets noticed too.
Bounce rates. Repeatedly sending to addresses that don’t exist is a strong signal of a poor quality list, and it damages your reputation as a sender.
Volume patterns. A domain that sends fifty messages a day for years and then suddenly sends five thousand looks like a compromised account. Increase volume gradually.
Domain age and history. A brand new domain has no reputation, which is not the same as a good one. New domains need to establish a track record.
Blocklists. Your sending IP or domain may appear on one, sometimes through no fault of your own if you’re on shared infrastructure. Worth checking if problems persist after authentication is correct.
Content. This matters less than most people assume. Excessive links, misleading subject lines and spam-trigger phrasing do have an effect, but if your authentication is broken, better wording will not save you.
Requirements Have Tightened
Major mailbox providers have moved from treating email authentication as good practice to treating it as a requirement, particularly for higher volume senders. Requirements and thresholds have changed more than once and continue to evolve.
The practical implication is straightforward: authentication that was adequate a few years ago may not be now, and it’s worth checking against current requirements rather than assuming a configuration set up in the past is still sufficient.
How to Check Your Own Setup
- Look up your SPF, DKIM and DMARC records. Free online checkers will show whether each exists and flag obvious errors. Several will also count your SPF lookups.
- Send a test message to a checking service. Various free tools give you an address to email, then report back on how your authentication performed on a real message. This is more informative than checking records in isolation, because it tests what actually happens.
- List every system that sends email as your domain. Mail platform, CRM, marketing tool, accounting software, website forms, booking systems, e-signature tools. Then confirm each is properly authorised. This exercise alone often explains the problem.
- Turn on DMARC reporting and actually read it. Use a tool that makes the reports readable. It will show you every service sending as your domain, which is frequently surprising.
- Check your own mail. Send to a Gmail, an Outlook.com address and a business address and see where it lands. Ask a few clients whether your messages arrive properly.
What Good Looks Like
- One valid SPF record, within the lookup limit, covering every legitimate sender, ending in a meaningful policy
- DKIM enabled and signing across all sending services
- DMARC published, moving beyond monitor mode once reports confirm it’s safe, with reports going somewhere a person actually looks
- A clean sending list with bounces removed
- Volume that grows steadily rather than in sudden bursts
The Practical Point
If your reply rates are worse than they should be and you’ve never checked any of this, the odds are reasonable that some of your mail isn’t arriving. It’s a fixable problem, it’s usually a configuration job rather than a large project, and it’s invisible until someone looks.
Need a Hand?
CCSW supports businesses across Cardiff and South Wales, including email configuration and deliverability. If your email isn’t landing where it should, get in touch or call 0333 014 4544.
