"Why are my enquiries going to spam?"
Email deliverability means making sure the emails your website and your business send actually reach the inbox. We set up three standard email settings, called SPF, DKIM and DMARC, keep checking them, and regularly test that your form alerts land in the inbox, not the spam folder.
In one sentence: we make sure email providers like Gmail and Outlook can tell your emails are genuinely from you, so enquiries from your website, and your replies to customers, arrive where people will see them.
Why do form alerts land in spam?
When someone fills in your contact form, your website sends you an email. Very often, that email says it's "from" your business address, but it's actually sent by your website's server, a machine your email settings have never heard of.
To Gmail or Outlook, that looks exactly like a scam: a message claiming to be from your business, posted by a stranger. It's like a letter on your company letterhead, arriving from an address you've never used. So the email lands in spam, or is quietly refused. Your website did its job, the customer did theirs, and the enquiry still never reaches you.
The fix isn't a setting inside the website. It's three small entries in your domain's settings that tell the world which senders are really you.
What can go wrong?
These three problems are common, and each one is invisible until someone goes looking:
- Enquiries "from" the customer that vanish. Some forms send the alert as if it came from the customer's own email address. Some big email providers tell everyone to refuse mail that claims to come from their addresses but doesn't. So enquiries from those customers are rejected before they reach you, and you never know they existed.
- The new email provider that broke the old setup. A business moves its email to a new provider. The new provider's sender details are added as a second entry next to the old one. Email rules allow only one such entry per domain. With two, the check breaks completely, and alerts, invoices and replies start drifting into spam.
- Someone else sending emails as you. A scammer emails your customers from your exact address, asking them to pay an invoice into a "new" bank account. Without the right settings, nothing tells their email provider that the message is fake.
The big email providers got stricter
Since February 2024, Google has required everyone who sends to Gmail to set up SPF or DKIM, and senders of more than 5,000 messages a day to have SPF, DKIM and DMARC. Microsoft brought in similar rules for large senders to Outlook in May 2025. Most small businesses send far fewer, but the direction is clear: unchecked email gets less trust every year.
SPF, DKIM and DMARC, without the headache.
All three live in your domain's DNS, the public settings that tell the internet where your website and email are. Think of DNS as the address book for your business name online.
SPF: the guest list
A short list of the services allowed to send email as your business: your email provider, your website, your booking system. Anything not on the list looks suspicious to the receiver.
DKIM: the wax seal
A hidden digital signature on every email you send. The receiver checks the seal against a key in your DNS. If it matches, they know the email is really from you and wasn't changed on the way.
DMARC: the instructions
Your note to every email provider: "If a message claims to be from me but fails the checks, here's what to do with it." It also asks them to send you reports, so you can see who's sending as you.
Why all three?
SPF and DKIM prove an email is genuine. DMARC is what turns that proof into action, and it only passes when the checked domain matches the address your customer actually sees. Together, they're the difference between "probably fine" and "definitely you".
Your email settings, kept under watch.
Email settings are easy to break by accident, often by someone fixing something else. So we don't set them once and walk away.
| What we check | When | Why it matters |
|---|---|---|
| SPF, DKIM and DMARC are present and valid | Regularly | A single typo or a duplicate entry can quietly send all your email to spam |
| Mail settings unchanged (MX records) | Regularly | MX records tell the world where to deliver your email. If they change, incoming mail can vanish |
| Your domain and server on spam blocklists | Regularly | Being listed means providers distrust everything you send |
| Form alerts land in the inbox, not spam | With each form test | Proves the whole chain works, not just the settings |
| The confirmation your customer receives | With form tests | A customer who gets no confirmation may assume you never got their message |
| DMARC reports: who is sending as you | Regularly | Spots forgotten services, like an invoicing tool, and anyone pretending to be you |
| Tighten the DMARC instructions, step by step | When the reports are clean | Moves from "just watch" to "refuse fakes", without blocking your own email |
Done carefully, in your first month.
The goal is simple: every email that's really from you passes the checks, and nothing you rely on gets blocked along the way.
Find every sender
Your mailbox, your website, your booking system, your invoicing tool. We list everything that sends email in your business name, with your help.
To startWrite one correct guest list
We combine them into a single, valid SPF entry and switch on DKIM signing for each service that supports it.
NextFix how your website sends
Form alerts go out through a proper sending service, from your own domain, with the customer's address set as "reply to". You hit Reply and it reaches them.
ThenWatch, then tighten
DMARC starts in watch mode: it reports but blocks nothing. Once the reports show only genuine senders, we tell providers to refuse fakes.
Over timeMonday, 8:00
Hi Steve, a good week. Your email settings are fully set up.
- Quote form tested: in your inbox in 5 seconds, not spam
- Email checks passing all week
- Your invoicing tool was sending emails as you without the right settings. We added it properly, so invoices should stop landing in spam.
- Next: tell email providers to refuse fakes, from 3 March
Names and numbers changed for illustration.
"In your inbox, not spam."
Your Monday note doesn't mention SPF or DKIM unless something needs you. It tells you what matters: your forms were tested, the alerts arrived in your inbox, and your email checks passed.
- Where each test enquiry landed, and how fast
- Any service we found sending as you, and what we did
- Anything that needs your OK, like a change with your email provider
Included in every plan.
Email checks are part of Protect, so they come with Keep, Grow and Full Care alike. No setup fee, month to month.
Keep
$100 / month
Your email settings set up and kept under watch, with form alerts tested regularly.
- SPF, DKIM and DMARC done properly
- Your enquiries, by name
- Weekly note and monthly page
Grow Recommended
$250 / month
Everything in Keep, plus we find where enquiries get lost before and after they're sent.
- Everything in Keep
- Where enquiries get lost
- Review replies, approved by you
Full Care
$500 / month
Everything in Grow, plus the work that adds up month after month.
- Everything in Grow
- Past-customer invites
- New pages and answers
What's not included?
We look after the settings that make your email trusted. The mailboxes and the messages themselves are yours:
- Running your mailboxes. Adding staff accounts, passwords and storage are handled by your email provider, or your IT company.
- Newsletters and marketing emails. We don't write or send newsletters. If you use a newsletter service, we make sure it's set up to send as you properly.
- Recovering a hacked email account. That's for your email provider. We'll check whether it affected your website or domain. If Google now shows a red warning on your site, see "Deceptive site ahead" warnings.
- Stopping lookalike addresses. DMARC stops people faking your exact address. It can't stop someone registering a similar-looking name. We'll tell you if we spot one.
- Email provider fees. Your email subscription stays with your provider, in your name.
Do it yourself, a freelancer, or Penguina?
| What you get | Do it yourself | A freelancer | Penguina |
|---|---|---|---|
| SPF, DKIM and DMARC set up correctly | Possible, but fiddly | Often | Yes |
| Sending services found and added | Easy to miss one | Sometimes | From the reports |
| Settings checked regularly | No | Rarely | Yes |
| Form alerts tested for spam | No | Rarely | Yes |
| DMARC reports read and acted on | Hard to read | Depends | Yes |
| Cost | Your time, and some trial and error | Varies by person | In every plan, from $100 a month |
What lost email means in your trade.
Every business loses something different when an email goes missing.
Heating and cooling companies
A broken boiler or air conditioner is urgent, and the customer will call the next company if you don't reply. Quote and call-out alerts have to reach the phone in your van, not a spam folder.
Wedding photographers
Couples often contact several photographers at once. Your reply with prices and availability has to land in their inbox, which means your own email needs the right settings, not just your website.
Massage therapists
Booking software often sends confirmations and reminders in your name. If it isn't on your sender list, clients may never see them. We find it in the reports and add it properly.
Questions about email and spam.
Something else? Ask in the chat, email hello@penguina.website or WhatsApp us.
Will changing these settings break my normal email?
Not the way we do it. We list the services that send as you before changing anything, and DMARC starts in watch mode, which blocks nothing. We only ask providers to refuse fakes once the reports show your genuine email passing.
Do you need my email password?
No. These settings live in your domain's DNS, so we need access to wherever your domain is managed. We never need to read your email.
I use a Gmail or Hotmail address for my business. Does this apply?
Partly. You can't change the settings for gmail.com or hotmail.com, but we can still make your website's form alerts reliable by sending them from your own website's domain. We'd also gently suggest an email address on your own domain, which looks more trustworthy to customers.
Can you stop scammers pretending to be my business?
For your exact address, largely yes. Once DMARC tells providers to refuse fakes, emails that pretend to be from your domain are far more likely to be blocked. It can't stop lookalike addresses with a letter changed, so we keep an eye out for those too.
What is a DMARC report?
A daily summary that big email providers send back about mail claiming to be from your domain: which services sent it, and whether it passed. It's written for machines, not people, so we read it for you and turn it into a line in your note.
My customers say they never got my reply. Is that the same problem?
Often, yes. The same settings that protect your form alerts protect every email you send in your business name. If replies are going missing, missing or broken settings are one of the first things we check.
Why has nobody mentioned this to me before?
Because it sits between two jobs. Web designers build the form, email providers run the mailbox, and the settings that connect them fall through the gap. That gap is exactly where we work.
Sources for the figures on this page
Not sure where to start? Send us your website.
We look at it the way a customer would, find up to 3 real problems, and fix one of them free. No call needed.