Why your contractor emails land in spam

Probably not the ones you think.

When an owner tells me their email goes to spam, they’re usually picturing a campaign. A promotion, a newsletter, something with pictures in it. That’s rarely what’s broken.

The email that’s quietly failing is the quote your office manager sent Tuesday afternoon. The invoice nobody paid because nobody saw it. The reply to a homeowner who thinks you ghosted them.

The short version

• Your business email and your marketing email usually run on two different setups. Only one of them gets maintained.
• The neglected one is normally your main domain, which carries your office’s quotes, invoices and replies.
• In more than a thousand domain setups, more than nine in ten arrived with authentication missing or wrong.
• Two lookups at mxtoolbox.com tell you who controls your DNS and where the domain was bought.
• Fixing it usually won’t change how your marketing performs. It stops your quotes from disappearing.

You have two email systems, and only one of them gets looked after

Most contractors don’t realize this, so it’s worth laying out.

Your business email runs on your main domain. Outlook or Google Workspace, whatever the office sends quotes, invoices and replies from. Nobody ever checks its DNS records, because nobody ever has a reason to.

Your marketing email, if somebody set it up properly, runs somewhere else. We use a delegated subdomain, something like email.yourcompany.com, with its own DNS records handled by the sending platform. That separation is deliberate. It limits how much campaign volume can touch the reputation of the domain your invoices go out on, though it doesn’t cut the tie completely, for a reason that comes up below.

Here’s why that matters for this article. If your marketing sends are landing and you still feel like you have a spam problem, you probably do. It’s just on the other system. And the other system is the one carrying money.

What we find when we open a contractor’s DNS

I’ve set up email authentication on more than a thousand domains over the last several years. Contractors mostly, plus the other small businesses that came through before we narrowed down to the trades.

More than 90 percent arrived with the records missing or misconfigured. That figure is my own estimate from doing the work, not a tally I kept in a spreadsheet, and you should read it that way. The pattern is not subtle enough to need one. Not slightly off. No DMARC at all, or a DKIM that was never enabled, or an SPF record authorizing a mail service the company stopped using years ago.

Two patterns come up over and over.

The registrar filled in an answer for you. Domains bought at GoDaddy often come pointed at Microsoft’s mail records, because GoDaddy sells Microsoft email alongside the domain. That’s fine if you send through Microsoft. If your office moved to Google Workspace two years ago and nobody touched DNS, your SPF record is now telling every mailbox provider on earth that your mail comes from somewhere it doesn’t. The record isn’t missing. It’s confidently wrong, which is worse, because nothing about it looks broken.

The hosting account answered for itself. Domains set up inside cPanel usually carry an SPF that authorizes the server’s own IP address and its MX record. That works for mail leaving the hosting account. It does nothing for mail sent through any outside platform, and most shops are sending through an outside platform without realizing the record never covered it.

Neither of these produces an error message. That’s the whole problem. A wrong SPF doesn’t bounce anything back to you. It just quietly lowers the odds on every message you send.

Does it actually cost you anything?

Honestly, not every time. I’ve seen shops running broken records whose mail mostly got through.

But more often than not, when the main domain’s SPF and DKIM are wrong, mail from the office starts landing in spam folders. And the failure is invisible from your end. There’s no bounce, no error, no notification. The homeowner just never answers, and everybody assumes they went with somebody cheaper.

Think about what actually goes out on that domain. Replies. Follow-ups. Quotes and invoices, if the office sends them from Outlook or Gmail. The messages where somebody was about to give you money.

If your estimates and invoices go out of ServiceTitan or Housecall Pro instead, check which address they come from. When the platform sends from its own address, your records don’t touch those messages. When it sends as your domain, which Housecall Pro now lets you switch on, your records have to authorize that platform too, and a stale SPF is exactly what sinks them. Either way, the replies your office types by hand ride on your main domain.

How to find out who controls your DNS

This is the step that stops most shops, and not for technical reasons. Those records live in DNS, and DNS usually lives with whoever built the website. For a lot of companies that’s somebody from four years ago who doesn’t return calls.

You can find out where everything sits in about five minutes, free, without asking anyone.

Go to mxtoolbox.com and run two lookups on your domain.

First, the nameservers. Whatever comes back tells you what platform is actually in charge of modifying your DNS records. That’s who has to make the changes, or whose login you need.

Second, whois. That tells you your registrar, meaning the site where the domain was purchased. That’s where you go to change the nameservers if you ever need to move control somewhere else.

Between those two lookups you know who holds the keys and where to go if they’ve disappeared. Write both down somewhere your bookkeeper can find them.

Can you do this yourself?

Yes, if you can get into your DNS.

It’s three DNS records. A competent IT person does it in under an hour. Plenty of owners have done it themselves from a registrar dashboard with a help article open in another tab. There’s no license to buy, no subscription, nothing recurring.

What stops people is access, not difficulty. If your nameservers point at a host nobody at your company can log into, you’re not fixing anything until you sort that out, and that’s a phone call rather than a technical problem.

If you’d rather hand it off, any local IT contractor can do this. You do not need a marketing agency for it, and you should be a little suspicious of anyone who tells you otherwise.

What the mailbox providers actually require

The reporting on this is consistently wrong in both directions, so here it is straight.

Sources: Google’s sender guidelines, Yahoo’s sender best practices, and Microsoft’s announcement for high-volume senders, effective May 5, 2025.

You’re under the bulk threshold, and you’re still not exempt

Your office sends a few dozen emails on a busy day. Nowhere near five thousand.

Every article written about these rules announces them like they apply to everybody. They don’t. But read the left column again. Gmail and Yahoo both want SPF or DKIM from every sender at any volume, and both want complaints under 0.3 percent. You aren’t exempt. You just have fewer boxes to tick, and the ones you do have are the ones nobody checked.

One catch worth knowing. Google counts every message sent from the same primary domain toward the 5,000, and once a domain crosses it, Google says it stays classified as a bulk sender permanently. Your office alone won’t get there. A single big campaign sent from a subdomain of it can.

Authentication is necessary. It isn’t sufficient.

If you take one idea from this page, take this one.

Read small business forums for long enough and you’ll find the same post over and over. Somebody set up DMARC, verified everything, and their mail still lands in junk. One thread is titled “My Email score is 10/10 and still it is being send to spam.”

Those people aren’t doing anything wrong. They’re finding out that the records get you through the door and reputation decides where you sit.

Reputation is mostly one number: how often people mark your mail as spam. Gmail and Yahoo both draw the line at 0.3 percent, and Google recommends staying under 0.1 percent.

The wrinkle is what they divide by. Both measure complaints against mail that actually reached the inbox, not against everything you sent. Yahoo says so plainly, and Google’s Postmaster Tools help defines it the same way. So the rate they’re judging you on isn’t the number you’d get dividing complaints by your whole list.

What a rejection looks like

Microsoft returns 550 5.7.515 when high-volume mail fails its authentication checks. If you’ve ever looked at a bounce report and seen that code, now you know.

Microsoft’s own announcement disagrees with itself about when that starts, which is worth knowing if you’re trying to make sense of a bounce. An update added in late April 2025 says failing messages are rejected with that code starting May 5, 2025. Two paragraphs left over from the original version, still on the same page, say failing mail goes to Junk first and gets rejected at a date to be announced. We can’t tell you which one Microsoft is enforcing on a given day. Assume the stricter one.

For scale on how common all this is, Red Sift scanned 73.3 million domains in December 2025 and found 83.9 percent with no DMARC record at all. Red Sift sells DMARC software, and its sample is drawn from the world’s most visited websites, so treat it as directional. A contractor’s domain is unlikely to be better kept than those.

One more failure worth its own line. SPF has a hard limit of ten DNS lookups. Go past it and the record doesn’t throw an error anybody sees. It just fails, and your mail gets treated as unauthenticated. Shops that have switched email providers a few times without cleaning up old entries hit this constantly.

What this means if you’re thinking about hiring somebody

Here’s the part a marketing company isn’t supposed to write.

Fixing your office’s records usually won’t make your marketing campaigns perform better. The way we set things up, campaigns run on a separate delegated subdomain with its own records, and they land whether or not your office mail is a mess. Anybody telling you your broken DNS is why your promotions underperform is probably selling you something.

What fixing it does is stop your quotes and invoices from disappearing. That’s a real problem worth real money, and it exists whether you ever hire an agency or not.

So go run the two lookups. If both records check out, you’re fine and you’ve spent five minutes. If they don’t, now you know what’s been happening to the quotes nobody answered.

If you do want us to run it

We set up authentication before anything sends. That’s week one, and the twenty-minute onboarding call exists partly so we can sort out who controls your DNS before it becomes a delay.

That applies to the trial too. A $599 send gets the same setup as a program client, because there’s no point testing a list through a channel that isn’t configured properly. And if the thing holding you back is whether you’re allowed to email these people at all, that has its own answer.

Questions we get

Why do my emails go to spam when I have SPF and DKIM set up?

Authentication makes you eligible for the inbox. It doesn’t guarantee placement. If the records are right and mail still lands in spam, the cause is usually reputation: complaint rate, an uncleaned list, or sending to people who don’t remember you.

Do the Gmail and Yahoo bulk sender rules apply to me?

The bulk rules start at 5,000 messages a day, which most contractors never reach. Both providers still require SPF or DKIM and a spam complaint rate under 0.3 percent from every sender at any volume. Google counts all mail from the same primary domain toward that 5,000.

What does the error 550 5.7.515 mean?

Microsoft rejecting a message because the sending domain didn’t meet its authentication requirements for high-volume senders.

Is it the images, or the word “free” in my subject line?

No published guidance from Google, Yahoo or Microsoft points at word lists or images. Their documentation covers authentication, complaint rates, and whether people want the mail.

How do I find out who controls my DNS?

Run your domain through mxtoolbox.com twice. The nameserver lookup tells you what platform modifies your records. The whois lookup tells you which registrar you bought the domain from, which is where you’d go to change the nameservers.

Will fixing this make my marketing emails perform better?

If your marketing runs on a properly configured sending subdomain, usually not. It’ll stop your business email from landing in spam, which is a different problem and usually a more expensive one.