Why Your Emails Land in Spam: The Hidden Causes Small Businesses and Nonprofits Never Check
A plain-English email tune-up, with free tools you can use today
You sent the quote. You sent the volunteer schedule. You sent the thank-you to your biggest donor. And then you heard, "I never got it."
When email goes missing, most people blame the person on the other end or their "spam settings." Usually, though, the problem is on the sender's side, and it's often something nobody thought to check. Here are the hidden causes I see most often with small businesses and nonprofits, and what to do about each.
1. Your email address is sitting on your website in plain text
If your Contact page says "Email us at mary@yourbusiness.com," automated scrapers will find it. They crawl websites all day collecting addresses. Once yours is on their lists, you get floods of spam, and scammers start sending fake messages that look like they came from you. Those fakes can drag down your domain's reputation, so your real email gets treated with more suspicion.
The fix:
-
Replace the plain address with a contact form that has spam protection, like a hidden "honeypot" field, Google reCAPTCHA, or Cloudflare Turnstile.
-
If you must show an address, use obfuscation that people can read but scrapers can't easily grab, and don't use a plain clickable
mailto:link. -
Publish role addresses like info@ or office@ instead of a person's name. If one gets buried in spam, you can filter it or retire it without changing everyone's personal email.
2. Your domain is missing its "ID card": SPF, DKIM, and DMARC
These are three short records in your domain's settings (DNS) that prove your email really comes from you:
- SPF lists which servers are allowed to send email for your domain.
-
DKIM adds a digital signature, so the receiving server can tell the message wasn't faked or altered.
-
DMARC tells receivers what to do when a message fails those checks, and can send you reports.
This stopped being optional in 2024. Google's sender guidelines require everyone sending to Gmail accounts to set up SPF or DKIM and to keep their spam complaint rate below 0.3%. Senders of more than 5,000 messages a day to Gmail need all three, plus one-click unsubscribe. Yahoo's Sender Hub lists similar rules, and since May 2025 Microsoft's Outlook.com has required SPF, DKIM, and DMARC from domains that send more than 5,000 messages a day.
You may never send 5,000 emails a day, but the providers' message is clear: unauthenticated mail is more likely to land in spam or be rejected. Common mistakes include having two SPF records (only one is allowed), forgetting to add your newsletter service or invoicing software to SPF, and never turning on DKIM at your email host.
3. You're using a free Gmail or Yahoo address for business
"yourbusiness@gmail.com" works, but it costs you. Customers trust it less, you can't set up SPF, DKIM, or DMARC for gmail.com yourself, and Google's guidelines specifically warn against using an @gmail.com address as the sender name for bulk email. A close cousin of this problem is a domain email that doesn't match your website, like a website at smithplumbingwi.com while you email from smithplumbing.net. Pick one domain and use it for both.
4. Your website's contact form sends email "as" the visitor
This one catches a lot of sites. When someone fills out your form, many older scripts send the notification from the visitor's address. If the visitor uses Yahoo or AOL, those domains publish a strict DMARC policy (p=reject) that tells receiving servers to refuse mail claiming to be from them that their own servers didn't send. So your form notification fails DMARC and quietly vanishes, and you never see the lead.
The fix: The form should send from your own domain (for example website@yourbusiness.com) and put the visitor's address in the Reply-To field. You still just hit "Reply." Also, don't let your form send an automatic copy of whatever the visitor typed to the address they entered. Spammers use that to blast spam through your server.
5. Your server's reputation (or a hacked site) is working against you
On inexpensive shared hosting, your site may send email from the same IP address as hundreds of other sites. Google's guidelines note that everyone on a shared IP shares its reputation. If a neighbor sends spam, your mail can suffer.
Worse is a hacked website. An outdated plugin or an unprotected form can be used to send thousands of spam messages from your domain. You often won't notice until you find yourself on a blacklist.
6. You're on a blacklist and don't know it
Blacklists (also called blocklists) are databases of IP addresses and domains that are known to send spam, and many mail servers check them. Getting listed can happen through a hack, a bad neighbor, or a spam complaint. The good news is that checking is free and takes a minute (see the checklist below). If you're listed, fix the cause first, then follow that list's removal steps.
7. Your newsletter habits are tripping filters
- Only email people who asked. Google's guidelines say not to buy email lists, and to confirm new subscribers.
-
Make unsubscribing easy. Your newsletter service should include a visible unsubscribe link and one-click unsubscribe.
-
Skip link shorteners. Google asks that links be visible and easy to understand. Shortened links hide the destination, and spammers use them heavily.
-
Avoid image-only emails. An email that's one big picture gives filters nothing to read and looks suspicious. It's also unreadable for people using screen readers. Use real text with a few images.
-
Clean your list. Remove addresses that bounce or haven't opened in a long time.
8. Old domains, lookalikes, and forgotten forwarding
- Expired domains. If you let an old domain lapse, someone else can register it and receive any email still sent to it. Renew the domains you've used for email, or retire them deliberately.
-
Typosquats. Scammers register lookalike domains (yourbusines.com, yourbusiness.co) to fool your customers. Consider registering the most obvious misspellings and pointing them at your site.
-
Old forwarding. Forwarding an old address to a new inbox can break SPF checks along the way, and forgotten forwards can send mail to accounts nobody watches anymore. Review where every address ends up.
Your self-check checklist (free tools)
- Find your email address on your website. Replace it with a protected contact form or a role address.
-
Run your domain through MXToolbox (mxtoolbox.com/SuperTool.aspx) to check SPF, DKIM, and DMARC, and confirm you have exactly one SPF record.
-
Check blacklists at mxtoolbox.com/blacklists.aspx and Spamhaus (check.spamhaus.org).
-
Send a test email to mail-tester.com and read your score and the reasons behind it.
-
Run Google's Check MX tool (toolbox.googleapps.com/apps/checkmx/) for setup problems.
-
Sign up for Google Postmaster Tools (postmaster.google.com) if you send newsletters to many Gmail users, to watch your spam rate and reputation.
-
Check Google Safe Browsing (transparencyreport.google.com/safe-browsing/search) to make sure your site isn't flagged.
-
Submit your own contact form using a Yahoo address and confirm the notification arrives.
-
Confirm your business email uses your website's domain, not Gmail or Yahoo.
-
List every domain you own and check the renewal dates and forwarding.
Next week: a 20-minute Google Business Profile tune-up that most businesses skip.
Jim Murphy is a U.S. Army veteran and the founder of Real Wisconsin Website Design, a veteran-owned and woman-owned web design company in Green Bay, building accessible, mobile-responsive websites for small businesses and nonprofits since 2007.
