Do your emails land in your customers' spam?

Why does your email end up in the recipient's spam?

Mail systems — Gmail, Outlook and the rest — check every incoming message to see whether it can be verified as coming from whoever it claims to come from. If it cannot, they treat it as suspicious: it may go to spam, or not arrive at all. This verification is set at your domain, and at many businesses it is incomplete, usually without the business knowing.

Gmail's sender guidelines expect it: at least one form of verification from every sender, and the full setup from anyone sending more than 5,000 messages a day. Some newsletter tools will not even start the first send without it.

And for the same reason, someone else can write in your name

Anyone can change the sender of an email, the way anyone can write any return address on an envelope. If verification is not set up at your domain, the mail system cannot filter out a message that arrives with your address but did not come from you. This is one route to a fake invoice: a fraudster puts your address as the sender and sends your customers a changed bank account number.

What a measurement showed

On 27 October 2026 I looked at the setup of 22 trade businesses outside Budapest, from public data. None of them has asked mail systems to discard forged email in their name, and 20 would not even get a report if someone wrote in their name. The figures, without names, are in a separate piece.

How it goes

• Day one. I set up the verification, in watching mode for now: it discards nothing, it only asks for reports, so your own email cannot get stuck. Domains of yours that send no email — an old name, an address registered for a typo — I lock down straight away, because no legitimate email leaves from them. If your website also sends email, such as form notifications, and I have access, I make that verifiable too.
• The month. Mail systems — Gmail, Microsoft, Yahoo and others — send daily reports on the email that arrived in your domain's name, and whether it passed the checks. I read these with a tool of my own, which is open source. You have nothing to do in the meantime.
• The report. Every sender by name — your host, Google or Microsoft, the newsletter tool, the invoicing service, the shop — and whether it passed. If there was forged email, that too. The to-dos in two columns: what I have already done, and what needs a few minutes of yours, with screenshots. The report is ready on day 30 even if your to-dos are still open.

The second step: discarding forged email

When every legitimate sender in the report is in order, the second step can follow: first, suspicious email goes to spam, then the mail system refuses it altogether. From then on, the large mailbox providers discard email that arrives with your exact address but did not come from you. This is €95 (HUF 35,000), and I suggest it once the report is clean.

After that, monitoring is €15 (HUF 5,000) a month: I keep reading the reports and tell you when a new sender appears or a legitimate one gets stuck — for instance when you start using a new invoicing or newsletter service. If I look after your website, this is part of the monthly fee.

What it does not protect against

The verification covers your own domain. There are two things it does not stop, and I write them in the report as well:

• a similar-looking address that a fraudster registers with one letter changed, an extra hyphen or a different ending;
• a compromised mailbox: if someone gets hold of a mailbox password, email from it goes out verified. Two-step sign-in protects against that.

Austria's national cybersecurity centre (CERT) lists both among the usual tools of fake-invoice fraud in its August 2026 warning, and recommends discarding forged email for your own domain.

When you do not need this

If you send from a gmail.com or other free address, there is nothing to set up. If your domain already discards forged email and someone reads the reports, the free check says so, without a quote. The same goes if it turns out your emails land in spam for another reason — the hosting server's address or the content, for instance: I tell you what the cause is.

SPF, DKIM, DMARC

The verification is three settings in the domain's DNS:

• SPF — lists the servers allowed to send email in the domain's name;
• DKIM — puts a digital signature on every message, which the receiver checks against a key published in the domain;
• DMARC — says what to do with email that fails the checks, and asks for reports on it.

On day one, DMARC starts in monitoring mode (p=none) with its own reporting address; for domains that send no email, SPF and DMARC reject everything. The second step is quarantine, then reject. The reports are read by dmarc-report-reader, which also shows which sender would fail under a stricter rule, and tells misalignment apart from a real authentication failure.

The three settings in more detail, with my own domain as the example: E-mail authentication for a small business.

Questions on this topic