Your Emails Are Going to Spam Right Now. You Just Don't Know It Yet.

James runs a commercial cleaning company in Glasgow. For nine months, every proposal he sent to office managers and facilities directors landed in their spam folders. He only discovered it when a client he'd been chasing for six weeks mentioned, almost apologetically, that she'd found his email "by accident." She almost missed it entirely. So did 21% of his revenue.

What Changed: Google and Yahoo Moved the Goalposts

In February 2024, two companies that collectively process over 50% of the world's business email made a quiet change with enormous consequences. Google and Yahoo began requiring email authentication for anyone sending more than 5,000 messages per day. By late 2024, the requirement had effectively expanded to all business senders — regardless of volume. If your domain doesn't have proper SPF, DKIM, and DMARC records, your email deliverability is degrading every month.¹

This wasn't announced with fanfare. Most business owners have no idea it happened. Their emails still send — they just don't arrive. The problem is invisible until someone tells you. And most people won't. They'll just assume you didn't reply.

The Real Cost of Doing Nothing

Let's quantify what James lost. He sends roughly 80 proposals per month — to prospective clients, existing customers with renewal quotes, and partners. At a conservative 30% response rate on properly delivered email, he should have been getting 24 responses a month. Instead, with 21% of his emails never reaching the inbox, he was losing 5 responses a month. Five conversations that never started. Five opportunities that evaporated silently.

His average contract value is £1,800. Five lost conversations per month, over nine months, at a 40% close rate: £32,400 in missed revenue. From three missing DNS records that take two hours to configure.

Now run the same calculation for your business. How many emails do you send per month? To clients? To prospects? To partners? What's a conversation worth to you? What's a lost conversation costing you?

The Three Records: What They Are, What They Do, and Why Yours Are Probably Missing

We're going to explain exactly what SPF, DKIM, and DMARC are. Not in abstract technical terms — in terms of what happens when they're missing, and what changes when they're in place. Because if you're going to fix this, you should understand what you're fixing and why it matters.

SPF: Who's Allowed to Send From Your Name

SPF (Sender Policy Framework) is a TXT record in your DNS that lists which servers are authorised to send email from your domain. Think of it as a guest list at a private event. Without SPF, anyone can walk in wearing your name tag. Spammers can — and do — send email that appears to come from your domain. When receiving servers see mail claiming to be from @yourcompany.com coming from an IP address not on your SPF list, they flag it. Repeated flags damage your domain's sending reputation. Eventually, all your email gets treated as suspicious — including the legitimate ones.³

A properly configured SPF record looks like this: v=spf1 ip4:YOUR_SERVER_IP include:your-email-provider.com -all. The -all at the end is critical — it tells receiving servers to reject anything not explicitly authorised. Most default setups use ~all (soft fail — "let it through but mark it") which provides almost no protection.

DKIM: Proving Your Email Hasn't Been Tampered With

DKIM (DomainKeys Identified Mail) is a cryptographic signature attached to every email you send. It proves two things: that the email genuinely came from your domain, and that nobody modified its contents in transit. Without DKIM, a malicious actor between your server and the recipient's server could alter your email — change the bank details on an invoice, for example — and nobody would know.³

Setting up DKIM requires generating a public/private key pair, publishing the public key as a DNS TXT record, and configuring your mail server to sign outgoing messages with the private key. This is the step most businesses miss — it requires both DNS access and mail server configuration, and most web developers never touch it.

DMARC: The Enforcement Mechanism

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do when either check fails. Without DMARC, even if you have SPF and DKIM configured, receiving servers are free to make their own decisions — and they default to leniency, which means spam folders.²

DMARC operates in three modes: none (monitor only — collect data, don't block anything), quarantine (send failures to spam), and reject (block delivery entirely). The recommended progression: start at p=none, monitor for a month to ensure legitimate email passes, then graduate to p=reject. At reject, your domain can no longer be spoofed. Period.

The Strategic Framework: How to Think About Email Authentication

We've now established what's broken, what it costs, and what fixes it. The remaining question is: how do you actually approach this? Here's the framework we use with every client. It takes two hours. It costs £297. And once configured, the records don't expire — this is a set-and-forget fix. No ongoing maintenance. No subscription. Your domain is permanently authenticated.

1. Audit your current setup. We run a diagnostic on your domain. Which records exist? Which are properly configured? Which are missing entirely? Most domains we check have partial SPF, no DKIM, and no DMARC. The diagnosis takes 30 seconds. The list of gaps takes another 30.
2. Configure SPF correctly. Not the default ~all soft-fail that your hosting company set up. A proper -all hard-fail that actually protects your domain. This requires knowing every service that sends email on your behalf — your mail server, your CRM, your invoicing system, your marketing platform. We identify them all and authorise only them.
3. Generate and publish DKIM keys. We create a 2048-bit RSA key pair, publish the public key in your DNS, and configure your mail server to sign every outgoing message. This step alone eliminates the most common reason business email goes to spam.
4. Deploy DMARC with reporting. We start at p=none — monitor mode. For 30 days, we collect reports showing exactly who is sending email from your domain, from which IPs, and whether SPF/DKIM checks pass or fail. At the end of the monitoring period, we graduate to p=reject. Your domain can no longer be spoofed.
5. Verify deliverability across providers. We test against Gmail, Outlook, Yahoo, and ProtonMail. We confirm your emails land in the primary inbox — not promotions, not spam, not silently discarded. We send you the results. If anything fails, we fix it before we close the case.

There's a Simpler Option: We Do It in Two Hours

You could do all of this yourself.

Or we do it in two hours for £297. Here's the trade:

This is not a negotiation about price. It's a decision about whether you want your emails to arrive or not. The price is £297. The cost of doing nothing — as James discovered — is measured in thousands.

What Happens After Your Email Works

Once your domain is authenticated and your emails reliably reach inboxes, something interesting happens. Your open rates recover. Your response rates recover. The conversations you didn't know you were missing start happening again. But more than that: your domain now has a sending reputation. Email providers track this over time. A domain with proper authentication that consistently sends legitimate email earns trust. That trust compounds. Your future emails are delivered faster, ranked higher, and treated with the presumption of legitimacy rather than suspicion.