Most business websites send email. They send contact form submissions, order confirmations, password resets and quote requests. When those messages arrive in the spam folder, or do not arrive at all, you lose enquiries and your customers lose confidence in your business.
In most cases the cause is the way the website sends the email. The wording of the message is rarely the problem. This article explains how mail providers decide what is spam, the most common setup mistakes, and how to fix them.
How mail providers decide what is spam
Gmail, Outlook and other mail providers check every incoming message. They look at two things. The first is whether the message came from the domain it claims to come from. The second is whether the server that sent it has a good record.
Three DNS records answer the first question:
- SPF lists the servers that are allowed to send email for your domain.
- DKIM adds a digital signature to each message. The receiving server checks the signature against a public key in your DNS.
- DMARC tells receiving servers what to do when a message fails SPF and DKIM, and where to send reports about your mail.
For DMARC to pass, SPF or DKIM must pass for the same domain that appears in the visible “From” address. This is called alignment. A message can pass SPF for your hosting company’s domain and still fail DMARC for yours.
The second question is about reputation. Mail providers keep a record of each sending server’s IP address and each sending domain. If other senders on the same server send spam, your messages can be treated as spam too.
The most common causes
The website uses the web server’s own mail function
Many websites send email with PHP’s built-in mail function, or with a WordPress plugin that uses it. The message leaves from the web server itself. On shared hosting, that server’s IP address is shared with hundreds of other websites. The messages usually have no DKIM signature, and your SPF record often does not list the web server. Mail providers treat these messages with suspicion.
The visitor’s address is used as the sender
Some contact forms put the visitor’s email address in the “From” field. If a visitor enters a Gmail address, your server sends a message that claims to come from Gmail. It fails every authentication check, and many providers reject it or move it to spam. The correct setup uses an address on your own domain as the sender and puts the visitor’s address in the “Reply-To” field.
SPF is incomplete or too long
Your SPF record must list every service that sends mail as your domain. Businesses often add a newsletter tool, a CRM or an invoicing system and forget to update SPF. SPF also has a limit of 10 DNS lookups. If a record includes too many services, SPF checks return an error, and that error counts against every message you send.
There is no DKIM or DMARC
Without DKIM, your messages carry no signature that proves where they came from. Without DMARC, receiving servers have no policy from you, and you receive no reports about who sends mail as your domain. Both records cost nothing to publish.
Several tools send as your domain
Your office email, your website, your newsletter tool and your accounting software may all send messages from your domain. Each one needs to be authorised in SPF, and each one should sign its messages with DKIM. One badly configured service can harm the reputation of the whole domain.
The server or domain is on a blocklist
If a server has sent spam, public blocklists record its IP address, and mail providers check these lists. A website that was hacked and used to send spam is a common reason for a listing.
Form spam harms your reputation
Bots fill in contact forms with fake details. If your form sends an automatic reply to the address in the form, your server sends email to thousands of addresses that never asked for it. Some of those addresses are spam traps run by mail providers, and messages to them harm your reputation quickly. Spam protection on your forms, and care with automatic replies, prevents this.
The rules changed in 2024
In February 2024 Google and Yahoo introduced new requirements for everyone who sends email to their users. Every sender must authenticate its mail with SPF or DKIM. Bulk senders, which Google defines as those that send about 5,000 or more messages a day to personal Gmail accounts, must also:
- publish SPF, DKIM and DMARC
- offer one-click unsubscribe on marketing email
- keep spam complaint rates low, and never reach 0.3%
In 2025 Microsoft introduced similar requirements for high-volume senders to Outlook.com addresses.
Most small business websites do not send enough mail to count as bulk senders. Mail providers now check authentication more strictly for all senders, though, and unauthenticated mail is more likely to be filtered each year.
How to check your own setup
You can check a message yourself in a few minutes:
- Send a test message from your website’s contact form to a Gmail address.
- Open the message in Gmail, select the three-dot menu and choose Show original.
- Look at the SPF, DKIM and DMARC results at the top. Each one should say PASS.
You can also send a test message to mail-tester.com, which scores the message and lists problems. MXToolbox checks your SPF, DKIM and DMARC records and tells you whether your domain or server is on a blocklist. If you already publish DMARC, its reports list every service that sends mail as your domain.
How to fix it
These steps solve the problem for most business websites:
- Send website email through a transactional email service. Services such as Amazon SES send each message from well-managed servers and sign it with DKIM for your domain.
- Use your own domain as the sender. Send from an address such as noreply@yourbusiness.co.za, and put the visitor’s address in “Reply-To” so that you can reply with one click.
- Make SPF cover every sender, within the 10-lookup limit. A custom MAIL FROM domain for your email service keeps its SPF record separate from your main one.
- Publish DMARC. Start with the policy set to
p=noneand read the reports for a few weeks. When every legitimate service passes, change the policy toquarantine. - Protect your forms. Use hidden fields and timing checks to stop bots, and limit how many messages one visitor can send in an hour.
- Send marketing mail from a subdomain. A problem with a newsletter campaign then does not affect your website and office email.
Keep your website and hosting up to date as well. A hacked site that sends spam will put your server back on the blocklists.
How we can help
Our own website sends its form email through Amazon SES, signed with DKIM for our domain, with DMARC in place. We can set up the same for the websites we build and host, and for your office email records.
If messages from your website go to spam, contact us with your domain name. We will check your DNS records and your website’s mail setup and tell you what we find. Our hosting page explains how we look after the sites we host, and our free speed check tests how quickly your site loads.
Filed under Hosting & Managed Servers, Web Development.