Business Email Going to Spam? Fix SPF, DKIM & DMARC — Delhi Office Guide (2026)

You sent an important proposal to a client. They never replied. Three days later they call to say they found your email in their spam folder. Or worse — they never found it at all.

This is not a one-off problem. For most Delhi SMEs and offices running their own domain email — whether on Microsoft 365, Google Workspace, or a hosting-based mail server — email deliverability failures are quiet, expensive, and completely fixable. The fix lives in three DNS records: SPF, DKIM, and DMARC. Most offices either have them misconfigured, missing entirely, or set up once years ago and never touched since.

This guide explains what each record does, why yours is likely broken, and what it costs to fix it properly. CNC has handled email authentication setup for Delhi offices since the days when it was called “anti-spoofing” — here is what we see every time.

Why Business Emails End Up in Spam

Receiving mail servers — Gmail, Outlook, Yahoo, corporate gateways — run every incoming email through a trust check before delivery. The check asks: is this email genuinely from the domain it claims to be from, and does the sending domain have a published policy that I should follow?

If the answer to either question is no, or cannot be verified, the email is either dropped into spam or rejected entirely. The three DNS records that answer these questions are:

• SPF (Sender Policy Framework) — lists the mail servers authorised to send email on behalf of your domain. If your mail comes from a server not on this list, it fails the SPF check.
• DKIM (DomainKeys Identified Mail) — adds a cryptographic signature to every outgoing email. The receiving server uses your public DNS key to verify the signature. A failed DKIM check means the email may have been tampered with — or was never signed.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) — tells receiving servers what to do when SPF or DKIM fails: deliver it anyway (none), put it in spam (quarantine), or reject it outright (reject). Without DMARC, every server makes its own call — and most spam filters err on the side of blocking.

All three work together. A domain that has SPF but no DKIM still fails DMARC alignment. A domain that has DMARC set to p=none (which just monitors, never acts) is indistinguishable from having no DMARC at all as far as deliverability is concerned.

The Most Common Mistakes CNC Finds in Delhi Offices

When we check a client’s DNS records before starting a network setup or security engagement, email authentication is broken in one of five predictable ways almost every time.

1. No SPF Record at All

The domain was registered, email was set up through the hosting provider or a third-party mail service, and nobody added an SPF record. This is the single most common finding. Every email from the domain looks unverified to receiving servers.

2. SPF Record with Too Many Lookups

SPF records are limited to 10 DNS lookups. Many older SPF records — especially on domains that have switched between mail providers over the years — exceed this limit. When the lookup limit is breached, the SPF check returns a permerror result, which most spam filters treat as a failure.

3. DKIM Not Configured for the Current Mail Provider

A business moves from a shared hosting email to Microsoft 365 or Google Workspace, but the old DKIM keys remain in DNS (or none were added for the new provider). DKIM signing either fails or is absent on every outgoing email.

4. DMARC at p=none Forever

Microsoft 365 and Google Workspace both prompt you to add a DMARC record during setup. Many administrators add p=none — which is correct as a starting point — but never move to p=quarantine or p=reject. In this state, DMARC is a reporting tool, not a protection tool. Spam filters give the domain minimal trust benefit.

5. Multiple Conflicting SPF Records

Only one SPF TXT record is allowed per domain. When hosting migrations, CRM tools, or marketing email platforms are added over the years, a second or third SPF record is often created instead of editing the existing one. Having multiple SPF records is an automatic SPF failure on many mail systems.

How to Check Your Current Email Authentication Status

You do not need specialist tools to do a first check. These three steps take under five minutes:

1. MXToolbox SPF Lookup — go to mxtoolbox.com/spf.aspx and enter your domain. It will tell you whether an SPF record exists, whether it has errors, and whether the lookup limit is exceeded.
2. Google Admin Toolbox Check MX — go to toolbox.googleapps.com/apps/checkmx/ and run a check on your domain. It flags SPF, DKIM and DMARC issues in plain language.
3. Send a test email to mail-tester.com — go to mail-tester.com, get a temporary address, send a normal business email to it, then check your score. A score below 8/10 means something is broken. Below 6/10 means your emails are very likely ending up in spam.

If any of these show issues, the fix is not complicated — but it does require DNS access and knowledge of your current mail provider’s specific requirements.

What a Correct Setup Looks Like — 2026 Delhi Office Reference

The following shows what correctly configured records look like for a Delhi office on Microsoft 365. The values differ for Google Workspace, Zoho Mail, and hosting-based mail — but the structure is the same.

SPF (for Microsoft 365)

TXT  @  "v=spf1 include:spf.protection.outlook.com -all"

The -all at the end is important — it means fail any server not on the list. Using ~all (soft fail) gives less deliverability benefit.

DKIM (for Microsoft 365)

DKIM for Microsoft 365 requires two CNAME records published in DNS — the keys are generated inside the Microsoft 365 admin portal under Email Authentication. The CNAME format looks like:

CNAME  selector1._domainkey  selector1-yourdomain-com._domainkey.yourtenant.onmicrosoft.com

DMARC

TXT  _dmarc  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100"

Start with p=quarantine rather than jumping to p=reject — this lets you catch any legitimate mail sources you missed in SPF before they start bouncing hard. Move to p=reject after two to four weeks of clean DMARC reports.

If Your Domain Is on a Blacklist

Sometimes the email deliverability problem is not just missing records — the domain or sending IP address has been blacklisted because a previous mail account on the same server was compromised, or because marketing emails were sent without proper opt-in lists.

Blacklist removal requires:

• Identifying which blacklists you are on (MXToolbox Blacklist Check is a free starting point)
• Fixing the authentication records first — submitting a removal request while still failing SPF/DKIM/DMARC is almost always rejected
• Submitting a delisting request directly to each blacklist operator
• Monitoring for 2–4 weeks to confirm the delisting held

CNC handles blacklist removal as part of the same email deliverability service for Delhi offices. Most major blacklist removals complete within 48–72 hours of a successful submission.

Email Authentication and Your Cyber Security

SPF, DKIM and DMARC do more than improve deliverability. They are also the primary technical defence against email spoofing — where an attacker sends emails that appear to come from your domain (your company name, your CEO’s address) to trick your clients, suppliers, or employees.

A domain with no DMARC record — or DMARC at p=none — can be spoofed by anyone. Your clients can receive emails appearing to be from you@yourcompany.com asking for a payment or a document, and there is no technical barrier stopping it. This is called a business email compromise (BEC) attack, and it is the leading cause of financial fraud targeting Indian SMEs in 2025–26 according to CERT-In advisories.

Proper DMARC at p=reject makes spoofing your domain effectively impossible. It is one of the highest-value, lowest-cost security measures a Delhi office can implement.

What CNC Fixes and What It Costs

Service	What’s Included	Indicative Price
Email Authentication Audit	Full SPF/DKIM/DMARC check, blacklist check, mail-tester score, written findings report	₹1,000 + GST (credited against fix)
SPF + DKIM + DMARC Setup	DNS record creation/correction, provider-specific DKIM configuration, DMARC policy set, verification test	₹2,500 + GST
Blacklist Removal	Blacklist identification, root-cause fix, delisting submissions, monitoring for 30 days	₹3,500 + GST
Full Email Deliverability Fix	Audit + SPF/DKIM/DMARC + blacklist removal + DMARC report monitoring for 60 days	₹5,500 + GST
Ongoing Email Health (as part of IT AMC)	Quarterly authentication check included in IT AMC plans	From ₹800/device/year

Prices are indicative. Please confirm current rates with CNC before proceeding.

Most fixes are done remotely — no site visit required. CNC needs read/write access to your domain’s DNS panel (GoDaddy, Cloudflare, BigRock, or your hosting provider’s cPanel DNS zone editor), plus read access to your Microsoft 365 or Google Workspace admin panel to generate the correct DKIM keys.

Time to complete: typically one to two hours for a standard SPF/DKIM/DMARC fix. DNS propagation takes up to 24–48 hours after that, though most changes take effect within a few hours.

Related reading

• Network security guide for Delhi businesses
• Microsoft 365 vs Google Workspace for Indian SMBs
• CNC Cyber Security Services, Delhi

Frequently Asked Questions

Why are my business emails going to spam even though I haven’t changed anything?

Email spam filters are updated continuously by providers like Google, Microsoft, and third-party gateway vendors. A configuration that passed two years ago may now fail because the spam-filter thresholds have tightened, a shared IP on your mail server was blacklisted by another user, or a newer DMARC standard has been adopted. The configuration needs to be checked, not assumed to still be correct.

Does my Microsoft 365 or Google Workspace plan include SPF, DKIM and DMARC setup?

Microsoft 365 and Google Workspace provide the tools and the documentation, but neither configures DNS records on your behalf — that requires access to your domain’s DNS registrar, which is outside their service scope. Setup is your IT team’s or IT partner’s responsibility. CNC handles this for Delhi offices as a standalone service or as part of an IT AMC.

How long does it take for the email fix to work?

DNS records propagate globally within 24–48 hours, though most records are active within 4–8 hours. DKIM verification is usually instant once the record is published. Blacklist delisting typically completes within 48–72 hours of a successful submission. DMARC report data starts arriving within 24 hours of the record going live.

Will fixing SPF, DKIM and DMARC guarantee my emails reach the inbox?

Correct authentication is necessary but not sufficient. Emails can still be filtered for content reasons (spam trigger words, excessive images, no unsubscribe link on bulk sends), sender reputation (new domain, low volume history), or recipient-specific filters. Authentication fixes the technical trust layer — content and reputation are separate factors. Most spam issues in Delhi offices are caused by authentication failures, so fixing these solves the problem in the majority of cases.

Can my emails be spoofed — someone sending fake emails pretending to be from my company?

Yes, if your domain has no DMARC record or has DMARC set to p=none. Anyone can send an email that appears to come from anyone@yourcompany.com and there is no technical mechanism to stop it. Setting DMARC to p=reject after verifying your legitimate mail flows makes spoofing your domain effectively impossible for external senders.

My email provider says they handle this — do I still need to do anything?

Email providers handle the sending infrastructure. SPF, DKIM and DMARC records live in your domain’s DNS — which is managed by your domain registrar or hosting company, not your email provider. Unless someone explicitly accessed your DNS panel and added these records, they almost certainly do not exist or are incomplete. Checking takes five minutes using MXToolbox.

What is the difference between SPF, DKIM and DMARC in plain language?

SPF is a guest list — it tells receiving servers which mail servers are allowed to send on your behalf. DKIM is a wax seal — it proves the email was not tampered with in transit. DMARC is the policy — it tells receiving servers what to do if the guest list check or the seal verification fails. All three are needed for full email trust.

Prices and rates mentioned in this article are indicative estimates as of September 2026, exclusive of GST unless stated, and may change without notice due to exchange-rate movements, supply constraints and market demand. Please confirm current pricing and availability with CNC before making any decision.