Why are my business emails going to junk?

Check this first: is it authentication?

You can see what Gmail thinks of your email in about a minute:

1. Send an email from your business address to a personal Gmail address (yours, or a family member's).
2. Open it in Gmail on a computer, click the three dots next to the reply arrow, and choose Show original.
3. Near the top are three lines: SPF, DKIM and DMARC. Each should say PASS.

Anything that says FAIL, NEUTRAL or SOFTFAIL, or a line that is missing, is your likely culprit. Do the same test with an email sent from each app that emails your customers: an invoice, a quote, a booking confirmation, a contact-form notification. Those are often where the problem is.

The three records, in plain English

SPF: one record, no more

For a business on Microsoft 365, the SPF record normally looks like this:

v=spf1 include:spf.protection.outlook.com -all

Each extra service that sends as you gets its own include: added to that same record. Two common mistakes break it completely:

• Two SPF records. Someone sets up a new app and adds a second SPF record rather than editing the first. More than one SPF record on a domain is an automatic failure.
• Too many lookups. SPF allows at most 10 DNS lookups. Keep adding includes and you pass that limit without noticing, and then SPF fails for everything.

DKIM: off until someone turns it on

Microsoft 365 signs email sent from your yourbusiness.onmicrosoft.com address automatically, but not email from your own domain. For that, someone has to publish two DNS records (selector1._domainkey and selector2._domainkey) and then switch DKIM on in the Microsoft Defender portal, under Email authentication settings. Microsoft generates the exact values for your domain, so copy them from the portal instead of from an example online. The format changed for domains added from May 2025.

Of the three records, this is the one we most often find missing. The tenant was set up, email worked, and nobody went back to turn DKIM on.

DMARC: start by watching, then enforce

DMARC is a single DNS record at _dmarc.yourbusiness.com.au. It has two jobs: it tells receivers what to do with mail that fails the checks, and it gets you reports on everything sent in your name. Roll it out in stages:

1. p=none: change nothing yet, just collect the reports. Within a few weeks they show every service sending as you, including ones you had forgotten about.
2. p=quarantine: once every legitimate sender passes, failing mail goes to junk.
3. p=reject: failing mail is refused outright. This is what stops scammers sending fake invoices from your domain.

Don't skip straight to reject. Microsoft 365 sends any mail that fails DMARC under a quarantine or reject policy through its "high-risk delivery pool", and Microsoft itself notes that many email systems don't accept mail from that pool. If your invoicing app isn't set up properly when you switch on enforcement, those invoices stop arriving.

The sneaky one: apps that email as you

Your mailbox might be perfect while the email that matters most (quotes, invoices, booking reminders) comes from somewhere else. Every system that sends email to customers falls into one of two groups:

• It sends from its own address, with your business name on the email and replies going to you. This is safe for DMARC because the app authenticates as itself. For example, Xero's email settings say invoices are always sent from messaging-service@post.xero.com and that this can't be changed. You set the display name and the reply-to address. Tradify also sends from its own domain.
• It sends as your address. Now it has to be authorised: either it sends through your own Microsoft 365 account, or you add its details to your SPF record and set up DKIM signing for your domain in the app. If neither is done, the email fails DMARC. ServiceM8, for example, can send through your connected Office 365 account or through your own mail server using its add-ons.

The worst offender is often the website contact form. Many websites send their notifications "from" your own address through the web host's mail server, which isn't in your SPF record and can't sign as your domain. Those enquiries end up in your own junk folder, or never arrive. The fix is to send form notifications through a proper authenticated email service, or from a subdomain set up for the purpose.

A good habit: whenever you sign up for a tool that emails customers, find its email or sender settings before the first invoice goes out.

Why this got stricter

This used to be optional. Since February 2024, Gmail and Yahoo have required every sender to have at least SPF or DKIM, and anyone sending in bulk to have SPF, DKIM and DMARC. In May 2025 Microsoft brought in the same bar for Outlook.com, Hotmail and Live addresses, rejecting mail from high-volume senders that don't meet it. And Google says that from November 2025 it has been ramping up enforcement, with non-compliant email facing "temporary and permanent rejections".

The bulk thresholds are high (Google's is around 5,000 messages a day to personal Gmail accounts), so a ten-person business isn't a bulk sender. But the direction is obvious, and the same checks feed into ordinary spam filtering. A small business with all three records set up properly is simply trusted more than one without them.

Other things that look like "junk" problems

• Sending from the onmicrosoft.com address. Microsoft now limits email from .onmicrosoft.com addresses to 100 external recipients per day across the whole organisation. It's rolled out to all tenant sizes during 2026. Past that, emails bounce. Make sure everyone sends from your real domain.
• Newsletters from Outlook. Microsoft says bulk email isn't a supported use of Microsoft 365. Send newsletters from a proper email marketing service, ideally on a subdomain like news.yourbusiness.com.au, so a complaint about a newsletter can't hurt your everyday email.
• A single customer's filter. If only one customer's company junks you and everyone else is fine, their IT may have a strict rule. Ask them to add your domain to their safe senders list, but check your records first.

Where we fit

Checking and fixing SPF, DKIM and DMARC is one of the first things we do when we take on a Microsoft 365 tenant, including tracking down every app that sends as you before any policy is tightened. It comes up a lot for trades businesses, where quotes and invoices go out from job software, and for allied health practices, where referrals and booking reminders need to reach people. If you'd like us to check your domain, it takes a few minutes and costs nothing.