Key takeaways
- Use email on your own domain (
name@yourbusiness.com) for credibility and control. - SPF, DKIM and DMARC DNS records prove your emails are genuine and keep them out of spam.
- Send website emails (contact forms, orders) through an authenticated SMTP service — not the server’s default mail function.
“Our website enquiries go to spam” and “customers didn’t get the order email” are among the most common problems I fix. The cause is almost always missing email authentication. Since 2024, Gmail and Yahoo require it for bulk senders — and it helps every sender.
Step 1: choose an email provider#
| Provider | Notes |
|---|---|
| Google Workspace | Familiar Gmail interface, strong deliverability |
| Microsoft 365 | Outlook, good for Office-centric teams |
| Zoho Mail | Affordable, popular in India |
| Host-provided email | Cheap but often weaker spam reputation and features |
Add the provider’s MX records in your DNS — see DNS explained.
Step 2: SPF — who may send for your domain#
Type: TXT Name: @
Value: v=spf1 include:_spf.google.com include:sendgrid.net ~all- One SPF record only — merge all senders into it.
- Include every service that sends as your domain: email provider, SMTP service, newsletter tool, CRM.
- Stay under 10 DNS lookups.
Step 3: DKIM — cryptographic signature#
Each sending service gives you a DKIM record (usually TXT or CNAME, e.g. google._domainkey). Add it to DNS and turn on signing in the service’s dashboard.
Step 4: DMARC — policy and reports#
Type: TXT Name: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourbusiness.com; adkim=s; aspf=s- Start with
p=noneto receive reports without affecting delivery. - Review reports (tools like Postmark’s free DMARC digests, dmarcian or Cloudflare’s DMARC management help).
- Once all legitimate senders pass, move to
p=quarantine, thenp=rejectto block spoofing.
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Step 5: fix website emails#
WordPress sends mail with PHP’s mail() by default, which is often unauthenticated and lands in spam. Install an SMTP plugin (FluentSMTP, WP Mail SMTP) and connect it to:
- Your Google Workspace / Microsoft 365 account, or
- A transactional email service: Postmark, Brevo, Amazon SES, Mailgun, SendGrid.
Send a test email and check the headers show spf=pass, dkim=pass and dmarc=pass.
Best practices for deliverability#
- “From” address on your domain, matching the authenticated domain.
- Use a Reply-To with the customer’s email for contact forms (this theme does).
- Separate marketing email (newsletters) from transactional email (orders, forms).
- Include one-click unsubscribe in marketing emails — see email marketing.
- Keep spam complaint rates very low; remove inactive subscribers.
Email deliverability FAQ#
Why do my contact form emails go to spam?#
Usually because they’re sent without SMTP authentication, or the From address doesn’t match an authenticated domain.
Will DMARC stop my emails?#
Not with p=none. Only move to quarantine/reject after confirming all legitimate senders pass.
Can I use Gmail.com for business?#
You can, but a domain email looks more professional and allows proper authentication.