First, see what Gmail makes of your mail
Send a message from your business address to a Gmail account you can open. Open it, choose Show original from the menu beside the reply button, and Gmail lists SPF, DKIM and DMARC near the top, each marked PASS or FAIL. That one screen tells you most of what follows.
SPF or DKIM, the minimum Gmail and Yahoo ask for
Since February 2024, Google asks everyone who sends to Gmail to set up SPF or DKIM for their domain, and Yahoo asks the same. SPF is a list, kept in your domain's settings, of the servers allowed to send your mail. DKIM is a signature on each message that proves it came from you. Without either, a quote or an invoice from your own address can land in spam or be turned away.
Your email provider publishes both. Google Workspace and Microsoft 365 each have a help page with the exact record, and it goes into your domain's DNS settings, usually where you bought the domain.
Two mistakes come up often. A domain may have only one SPF record, and with two of them mail servers treat SPF as failed. And a newsletter, booking or invoicing service that sends mail as you needs its own setup for your domain, or those messages go out without your domain's approval.
DMARC, for mail that pretends to be you
DMARC tells receiving servers what to do with mail that fails those checks. Google requires it of anyone sending more than 5,000 messages a day to Gmail, and Yahoo urges every sender to publish one. Without it, nothing tells a mail server to turn away a message that only pretends to come from you.
It is often missing. I ran my check on 195 business websites in Los Gatos and Campbell, and 78 of them had no DMARC policy for their domain. The findings page has the rest.
Start gently. Google recommends beginning with a policy of none, which changes nothing about delivery and sends you daily reports. It is a TXT record named _dmarc at your domain, with a value like v=DMARC1; p=none; rua=mailto:[email protected], using an address at your own domain for the reports. Once the reports show only your own services sending as you, change none to quarantine, which sends failing mail to spam, and later to reject, which refuses it.
What settings cannot fix
These records prove the mail is yours. They don't make people want it. Mail that recipients mark as spam, or that goes to lists bought or years old, can still land there, and no outside check can see where a message ends up.
Check yours in half a minute
The free email check reads all three records for your domain and for the addresses on your site, and when DMARC is missing it gives you the record to paste. It reads public settings only and sends no message. If you would rather have it done, fixing email records is part of the Site tune-up.