Skip to content
Breitloh

Email that reaches the inbox

Nothing announces itself when email quietly fails. There is no bounce and no error message, just a quote nobody replied to and a reminder somebody swears never arrived. Most of the time the fix is three DNS records, an hour of care, and a fortnight of watching what comes back.

Book a callWebsite support and maintenance

Ten of my fifteen years were spent on enterprise platforms, mostly ServiceNow, for FTSE 100 companies, central government departments, and local authorities. Mail flow, notification rules, and the arguments about which system is allowed to send as the organisation are ordinary work there.

Three authentication records signed off, sending mail to the inbox rather than the junk folder

Where it usually hurts

Nothing tells you it failed
Gmail and Microsoft rarely bounce a message they distrust. They file it. So the invoice is delivered, technically, into a junk folder nobody has opened since March, and you find out when somebody chases you for a chase you already sent.
Your website sends as you, badly
Form notifications, receipts, and password resets often go out straight from the web server, which was never listed as allowed to send for your domain. That is a failed check on every message, and it is why contact form emails are the first thing to disappear.
One campaign damages everything
Marketing and transactional email sent from the same domain share a reputation. A newsletter with a poor list behind it drags your invoices down with it, and nobody connects the two until somebody misses a payment run.

What the job covers

  • An inventory of everything sending as your domain today, including the tools nobody remembers signing up for
  • SPF, DKIM, and DMARC published and then checked from outside, not just declared done
  • DMARC taken from monitoring to enforcement once the reports come back clean, rather than left on none forever
  • Transactional mail separated from marketing, so a campaign cannot take your invoices down with it
  • A short written record of what changed, what it proves, and what to watch

What it has to talk to

Microsoft 365 or Google Workspace
Whichever runs your mailboxes stays exactly as it is. The work happens in DNS and in the sending tools around it, so nobody has to log in anywhere differently on Monday morning.
Everything else that sends as you
Invoicing software, the CRM, the booking tool, the newsletter, and the website. Each one needs authorising properly, and each one is a way in for somebody spoofing you if it is left half done.
Your DNS, wherever it lives
The records sit with whoever answers for your domain, which is not always who you think. Finding that out is usually the first ten minutes of the job.

A worked approach, not a client

How I would sort out email that keeps landing in spam

  1. 01

    Find everything that sends

    Every system that puts your domain in the from line, listed. There are almost always two or three nobody expected, and one of them is usually the reason for the trouble.

  2. 02

    Publish, then verify from outside

    SPF, DKIM, and DMARC set up for each legitimate sender, then tested from an address that has nothing to do with your organisation, because a message to a colleague proves nothing.

  3. 03

    Watch, then enforce

    DMARC reports read for two weeks, anything legitimate that is failing gets fixed, and only then does the policy move to quarantine and reject. Turning that on first is how people break their own email.

Questions I get asked about this

The ones that come up on almost every first call. If yours is not here, ask it and you will get a straight answer.

What are SPF, DKIM, and DMARC, in plain English?

Three records in your domain's DNS. SPF lists which servers are allowed to send as you. DKIM signs each message so it cannot be tampered with in transit. DMARC tells receiving servers what to do when something fails those checks, and asks them to report back. Together they are how Gmail and Microsoft decide whether you are you.

Our emails go to spam. Is it the content or the setup?

Nine times out of ten it is the setup, and it is worth ruling that out before anyone starts rewriting subject lines. Authentication is objective: either the records are right or they are not. Content matters at the margins, after the technical part is clean.

We are on Microsoft 365. Is this not already done?

Microsoft publishes an SPF record for you and enables DKIM for its own domain, not necessarily for yours, and DMARC is off unless somebody turned it on. The common state is SPF present, DKIM half configured, and DMARC missing entirely, which is exactly the gap somebody spoofing you would use.

What does a DMARC policy of none, quarantine, or reject mean?

None means watch and report but deliver anyway. Quarantine means put failures in junk. Reject means refuse them at the door. Everyone should start at none, read the reports, and end at reject. Sites that sit on none for years get the reporting and none of the protection.

How long before we see a difference?

Authentication changes take effect as soon as DNS propagates, usually within an hour. Reputation, which is the other half, recovers over a few weeks of clean sending. If a domain has been used for something poor for a long time, that part takes longer and I will say so rather than promise a week.

Will this fix our newsletter landing in the promotions tab?

Partly, and that is worth being honest about. Authentication decides spam or inbox. The promotions tab is a separate judgement about what the message looks like, and a marketing email will often sit there whatever you do. The emails you cannot afford to lose are the transactional ones, and those are the ones this fixes.

Do the emails our website sends count?

They are usually the worst offenders. Any form, booking confirmation, or receipt going out from the web server rather than through a mail service will fail authentication. Every site I build sends through a proper service for exactly this reason, and it is the same job whether the site is a booking system, a membership system, or a rebuild off WordPress.

Can you do this if we do not control our own DNS?

Yes, though it needs whoever does to make the changes, and finding that person is sometimes the longest part. If your domain is held by a former agency or a member of staff who left, sorting the domain out comes first, because you should not be one unpaid renewal away from losing your email.

Is this a one off or something ongoing?

The setup is a one off. What is worth continuing is watching the DMARC reports, because a new tool added six months from now will fail quietly the same way the old ones did. That is a small part of the monthly arrangement, not a separate retainer.

Related

Tell me what you have now

Half an hour on a call, and a straight answer about whether this is the right job and whether I am the right person for it.

Book a callhello@breitloh.com