A client called saying they never received the appointment confirmation. It was in the spam folder — or they never found it at all. Confirmations, offers, invoices and password reset messages are emails that, if they land in spam, mean the client doesn't know they're booked, that the offer is still valid, or that they need to pay. When emails don't reach the client, the business loses money and spends time on explanations.
On this page you'll learn why business emails land in spam even though you're sending them through a service that "should work." You'll learn about the three email authentication mechanisms — SPF, DKIM and DMARC — and what Gmail requires from all senders starting February 2024. You'll also get a checklist you can verify yourself without any technical knowledge.
Why business emails land in spam
Gmail and other email providers don't just check the message content. They also verify whether the sender is who they claim to be. If the sending server doesn't have the proper DNS records, the message is treated as potentially unsafe and lands in the spam folder — regardless of what's inside.
Emails that must reach the client include:
- appointment and booking confirmations,
- offers and responses to inquiries,
- invoices and payment reminders,
- password reset links.
When a client doesn't receive a confirmation, they may assume the booking failed and go to a competitor. When they don't receive an invoice, they don't pay on time. This is a direct financial loss.
What this means in practice
Imagine this: a client books an appointment through your website form. The system sends a confirmation, but it lands in spam. The client waits for confirmation, doesn't receive it, books elsewhere. You only find out when the client calls to complain — or you never find out at all.
How much you can lose
Using assumed figures of 200 PLN per appointment, that comes to 1,000 PLN a month. This isn't an industry statistic — plug in your own numbers to see the real scale for your business.
How it works on Gmail's side
Gmail applies filters that evaluate messages based on many factors. One of the key factors is whether the sender passes authentication. A message without proper SPF or DKIM is treated as potentially spoofed — even if the content is completely innocent.
What SPF, DKIM and DMARC are in one table
These are three different email authentication mechanisms. Each one checks something different:
| Mechanism | What it checks | How it works |
|---|---|---|
| SPF (Sender Policy Framework) | Whether the sending server is authorized to send on behalf of the domain | You add a DNS record listing which servers are allowed to send mail for your domain |
| DKIM (DomainKeys Identified Mail) | Whether the message wasn't altered in transit | The sender signs the message with a private key, the recipient verifies it with the public key in DNS |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | What to do with messages that fail SPF or DKIM | A DNS record tells the recipient: do nothing (none), move to spam (quarantine), or reject (reject) |
Gmail's minimum for a small business is working SPF or DKIM. DMARC is mandatory above 5,000 messages a day, but it's worth having earlier.
Gmail requirements for all senders
Since February 1, 2024, Gmail requires everyone sending messages to Gmail accounts to meet several conditions. These aren't optional recommendations — without them, messages may not reach the inbox or may land in spam.
Requirements for all senders:
- Configure SPF or DKIM for your sending domain. Either of these two mechanisms is sufficient.
- Ensure the domain or IP has proper forward and reverse DNS records (also known as PTR records).
- Use encrypted TLS connection when transmitting messages.
- The spam rate in Postmaster Tools must be below 0.3%.
- Messages must be formatted according to RFC 5322 standard.
- Don't impersonate Gmail From: headers.
Requirements when sending more than 5,000 messages per day
If your business sends more than 5,000 messages per day to Gmail accounts, the requirements are stricter. This doesn't mean smaller businesses can ignore them — it's worth knowing these requirements to make informed choices about sending services.
Additional requirements for high-volume senders:
- Configure both SPF and DKIM — both mechanisms must work.
- Configure DMARC for your sending domain. The policy can be set to none, but the record must exist.
- For direct email (without an external service), the domain in the From: header must match the SPF or DKIM domain (called DMARC alignment).
- Marketing and subscription emails must support one-click unsubscribe and include a visible unsubscribe link in the message body.
Requirements for sending 5,000 or more messages per day — Gmail Help
Who is responsible for configuration when using external services
A typical business doesn't send email directly from its own server. Messages come from multiple sources at the same time:
- forms on the website,
- CRM system,
- newsletter sending service,
- accounting software with invoice sending,
- online booking system.
Each of these tools sends emails "on behalf of" the company domain. If the domain is, for example, mycompany.com, all these services must be included in the DNS configuration — otherwise Gmail sees messages from many "unknown" senders and treats them as suspicious.
Who manages the domain DNS? Usually the company that sold the domain (registrar) or the hosting provider. You need to know who has access to the DNS panel and whether they can add the required records. Without this, proper authentication configuration isn't possible.
Why you shouldn't send business emails from a personal Gmail account
A common practice in small businesses: the owner sends offers from an address like john.smith@gmail.com, signing with the company name. Technically such a message passes Gmail authentication, but the client sees "Company XYZ" next to a private address in the From: header — and it's easy to mistake for a scam.
Consequences:
- The client may find the message suspicious and not open it.
- The client can't be sure whether the message actually comes from the company.
- It's harder to track whether messages were delivered (no centralized logging).
If the business needs its own email address but doesn't have its own server, the solution is to configure the domain in Google Workspace or use an external service with proper configuration.
How to check if your emails land in spam
You don't need technical knowledge to verify whether email from your systems works correctly. A simple test is enough:
- Send a test message from each system you use (website form, CRM, accounting software) to a Gmail address.
- Check whether the message landed in the inbox, not spam.
- If it landed in spam, mark it as "not spam" so Gmail learns this is wanted mail.
- Repeat the test from each source separately, at least once per quarter.
More technical details — DNS records, server configuration — are the job of whoever manages your domain. You just need to know that the problem exists and who to contact for a fix.
Checklist: what you need to verify
Before you assume sending works correctly, go through this list:
- List all systems that send messages on behalf of your domain (forms, CRM, programs, integrations).
- Find out who has access to the domain DNS panel — this is the person responsible for adding SPF, DKIM and DMARC records.
- Check whether the contact information in the .pl Domain Registry is up to date. NASK recommends that the subscriber's email be current and that you renew the domain without waiting until the last day.
- Test sending from each system to a Gmail account — whether the message reaches the inbox.
- Repeat tests quarterly, especially after changes to systems or adding new integrations.
To learn more about organizing query handling, read the article Query handling automation: one queue instead of five inboxes. You'll learn how to centralize correspondence and avoid situations where messages get lost between inboxes. About follow-up automation, read Follow-up automation: what happens to the inquiry after the first conversation, and about what customer data the system processes, read Automation and GDPR: where your customer data physically ends up. If you're just starting to organize your processes, see Where to start automation in a small business: four thresholds instead of general analysis.
What proper configuration looks like
When a business uses a system that ensures proper sending, the process works like this:
- 01client booking
- →02email sent
- →03SPF/DKIM verification
- →04inbox delivery or bounce
- →05checking the cause
This gives the business control over whether messages actually reach recipients and lets them react to problems instead of learning about them from clients. This is offered by Email integrations — all messages go out from one, correctly configured sender, and confirmations and offers go out on their own when a client takes a specific action. Additionally, Automatic messages let you configure confirmations, reminders and thank-you messages that go out automatically after a system event. CRM and automations help organize the entire flow of bookings and messages in one place, and Lead forms let you collect inquiries in a few short steps with conditional logic. If you also need a new website built around one customer decision, see Websites and stores.
Frequently asked questions
Do I need to configure all three mechanisms: SPF, DKIM and DMARC?
No. For most small businesses, SPF or DKIM is enough. DMARC only becomes required when sending more than 5,000 messages per day. However, having both (SPF and DKIM) significantly reduces spam risk even at smaller volumes.
If I send 100 messages per month, can I ignore Gmail's requirements?
No. The requirements apply to all senders since February 2024, regardless of volume. The difference is that at small scale you don't need to configure DMARC, but lacking SPF or DKIM can still cause delivery problems.
What if I use an external sending service (e.g., mailing, cloud CRM)?
Make sure the service uses your domain in the From: header and that their servers are included in your DNS configuration. Ask the provider whether they have SPF and DKIM properly configured for your domain. If not, ask them to add the appropriate records or change services.
How do I check if my domain has SPF configured?
You can use online tools (e.g., MXToolbox) or ask the person managing DNS. An SPF record looks something like: v=spf1 include:_spf.domain.com ~all.
Is it safe to use a free Gmail account for sending business emails?
It's not recommended for business messages. The client sees a private address instead of the company domain, it's harder to trust the message, and the business has no shared record of correspondence. It's better to use an address from your own domain.
What is DMARC alignment and why does it matter?
DMARC alignment means the domain visible in the From: header must match the domain checked by SPF (the return address) or the DKIM signing domain. If you send from address support@mycompany.com but the message is signed by an external service's server, the domains must match. Otherwise, Gmail may consider the message suspicious.