It has probably happened to you: you put together the monthly invoice, email it to your client, and it never arrives on the other end. Or worse, it shows up days later in the spam folder, right next to casino promos and a Nigerian prince's inheritance. You know your email is legitimate, but the recipient's server does not, and when in doubt it dumps you at the bottom. In a business, this is not a minor detail: an order confirmation that never arrives, a quote that gets lost, or an appointment reminder the client never sees are sales and trust slipping away through a technical hole almost nobody looks at.
Why your emails end up in spam
Email was invented in an era when nobody lied about who they were. Because of that, by default, anyone can send a message claiming to be you. Providers like Gmail, Outlook, and Yahoo know this, so over the past few years they have become stricter and stricter: if they cannot verify that a message really came from a server authorized by your domain, they treat it as suspicious. And "suspicious" almost always means spam.
Two main causes usually combine. The first is the reputation of the IP your mail is sent from. On shared hosting, your domain lives alongside many others on the same IP address. If a neighbor on that IP misbehaves and blasts spam, the reputation gets dirty for everyone, including you, who did nothing wrong. The second cause, the most common and the easiest to fix, is a lack of authentication: you have not set up the records that tell the world "this server has permission to send on my behalf." Without those records, you are a stranger knocking at the door.
SPF, DKIM and DMARC in plain English
These three names sound scary, but they are simply three notes you add to your domain's DNS (the public directory that says where each part of your website and email lives). Think of them as three security layers at the entrance of a building.
SPF: the list of authorized doormen
SPF (Sender Policy Framework) is a record where you declare which servers are allowed to send email using your domain. It is like handing the doorman a list of who may enter in your name. When one of your emails arrives, the recipient's server checks that list: if the sender is on it, they pass; if not, suspicion kicks in. A typical SPF record is that simple: it names your hosting's mail server and ends with an instruction about what to do with senders who are not on the list.
DKIM: the signature that cannot be forged
DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email, generated with a secret key that only your server knows. On the other end, the provider uses a public key (published in your DNS) to confirm the signature is authentic and that nobody tampered with the message along the way. It is like the wax seal on old letters: if it arrives intact, you know it is genuine. DKIM is what gives your email real weight in the eyes of Gmail and the rest.
DMARC: the policy that ties it all together
DMARC (Domain-based Message Authentication) is the boss that unites the other two. With DMARC you tell the provider what to do when an email claims to be yours but fails SPF and DKIM: do you let it through anyway, send it to spam, or reject it outright? On top of that, DMARC sends you reports about who is sending in your name, which lets you spot whether someone is using your domain to run scams. It is the difference between having your security cameras on or off.
How to set them up, step by step
The good news is you do not need to be a programmer. Almost everything is done from your hosting panel, usually cPanel, or from wherever you manage your domain's DNS. The general path looks like this:
- SPF: in cPanel, many hosts generate it automatically when you activate email. If not, in the DNS zone you add a TXT record with the value your hosting provider gives you.
- DKIM: this is also enabled from cPanel, in the mail authentication section (Email Deliverability). One click generates the key and publishes the record; in many cases it is literally pressing "Enable."
- DMARC: you add it as a TXT record in the DNS. It is best to start with a soft policy (monitor only) and, once the reports show that everything legitimate passes correctly, tighten it so fake mail goes to spam or gets rejected.
- Always verify: there are free online tools where you enter your domain and they tell you whether the three records are set up correctly. Do not assume it worked: check it.
One important detail: DNS changes can take a few hours to propagate across the whole internet. If you configure and test five minutes later, it may not be reflected yet. Be patient and check again later.
Other best practices that make a difference
Authentication is the foundation, but there are habits that help your mail earn a good name so you do not get filtered anyway:
- Do not use a @gmail address for your business. Sending invoices from "mystore2024@gmail.com" screams amateur and lowers trust. Use professional email on your own domain, like hello@yourbusiness.com.
- Warm up the domain gradually. If it is brand new and you suddenly send 5,000 emails, the filters panic. Start with low volumes and ramp up slowly to build reputation.
- Avoid spammy words and all-caps subject lines. "FREE!!!", "YOU WON", too many exclamation marks, and strange links trip the filters. Write the way you would to a trusted client.
- Keep your lists clean. Remove addresses that bounce and anyone who unsubscribed. Insisting on dead mailboxes destroys your sending reputation.
- Mind the text-to-image balance. An email that is one giant image with no text is suspicious. Combine both.
The hosting factor: what almost nobody tells you
You can do all of this perfectly and still fight with deliverability if your hosting sits on an IP with a bad reputation or does not give you the tools to configure authentication. That is where a good provider saves you headaches: a well-set-up cPanel to enable SPF and DKIM in two clicks, servers with good IP reputation, and above all support that actually understands what you are talking about when you open a ticket saying "my emails land in spam." Believe me, the difference between solving it in one afternoon or battling it for a week comes down to exactly that.
That is why, when someone asks us what to check before signing up, we always include the email side. In our experience testing options for this kind of need, BanaHosting handles this part well: it comes with cPanel to configure SPF, DKIM, and DMARC without hassle, runs on real SSD drives with good reputation, and offers 24/7 support in Spanish that knows these topics, so if one day your emails start landing in spam, you have someone to ask without getting answered in another language three hours later. That kind of backup, more than any trick, is what ultimately gets your invoices into the inbox.