Why do my invoices go to the customer’s spam folder?

Nothing broke. The rules changed.

For years, mail servers accepted almost anything and sorted it out later. Then the volume of fraud made that untenable, and in 2024 Google and Microsoft, who between them receive most business email in South Africa, began requiring senders to prove who they are. Mail that had arrived fine for a decade started going to spam, with no warning and no bounce message, because a message that is quietly filed is not a failure as far as the sending server is concerned.

Which is why this is usually discovered the expensive way: a client says they never got the quote, and you find it in their junk folder while they are on the phone.

The three records, in plain English

SPF is a list. It says: these are the mail servers allowed to send email using my domain. Your mail provider, your accounting package, whatever sends your invoices. Anything not on the list is not from you.

DKIM is a signature. Each message gets stamped in a way that proves it really came from your provider and was not altered in transit.

DMARC is the instruction. It ties the other two together and tells the receiving server what to do with a message that fails them: ignore it, treat it as spam, or reject it outright. Without DMARC, the first two are advisory, you have written the rules down and told nobody to enforce them.

All three are free. They are public records on your domain, they take an hour or two to set up properly, and they are done once.

The part that costs real money

Spam filtering is the visible symptom. The expensive one is the other direction.

Without DMARC, anyone can put your address in the From field of an email. That is not a hack and it needs no skill, it is a field in a form. The standard version: your customer receives an invoice that appears to come from you, at roughly the time they were expecting one, with the attacker’s banking details on it. They pay. You find out weeks later when you chase the money, and the conversation that follows is about whose fault it is.

Because these records are public, anyone can check in seconds whether a business is protected. That check works equally well for someone deciding which business to impersonate.

How to check yours

The free check on this site reports it as one of its ten checks, with no sign up. If you would rather look yourself: your domain’s TXT records should contain one record starting v=spf1 and ending in ~all or -all, and there should be a record at _dmarc.yourdomain.co.za with a policy of quarantine or reject.

Two things worth knowing, because both are common and both look fine at a glance. Two SPF records is worse than one, the standard allows exactly one, and receiving servers treat a pair as an error and ignore both. And a DMARC policy of none monitors without instructing anybody to do anything, which means you have the paperwork and none of the protection.

Getting it fixed

Publish a single SPF record listing every service that sends mail for you. Switch on DKIM with your mail provider, usually a setting rather than a project. Add DMARC at none, watch the reports for a fortnight to catch anything legitimate you forgot, then tighten it to quarantine.

It is an hour or two of work. I charge R800 for it. Anyone competent will charge something similar, and nobody should be selling it to you as a monthly service, because once it is right it stays right until you change mail providers.