Why Your Invoices Land in Spam: DMARC, SPF and DKIM for Singapore SMEs

If your quotes and invoices keep landing in spam, the usual cause is not the wording, the attachment or the client's IT department. It is that your domain has never told receiving mail servers who is allowed to send email in its name. Three DNS records do that job: SPF, DKIM and DMARC. Until all three are published and DMARC is set to quarantine or reject, Gmail, Outlook and corporate filters treat your mail as unverified, and unverified mail from a small unfamiliar domain is the first thing a filter sets aside. Fixing it is a DNS task, normally a few hours of work spread over a month of monitoring, and it costs nothing in software licences.

What do SPF, DKIM and DMARC actually do?

Treat them as three checks the receiving mail server runs in under a second, before a human ever sees your email.

• SPF is a public list of the servers allowed to send mail using your domain name. Your mailbox provider is on it. So should be your accounting system, your CRM and your website contact form.
• DKIM adds a cryptographic signature to each message, so the receiver can confirm the email really came from your domain and was not altered on the way.
• DMARC tells the receiver what to do when the first two checks fail, and asks for a regular report naming every system that sent mail as you.

Most Singapore SMEs we look at have a half-finished SPF record, DKIM switched on for the mailbox but not for the accounting or marketing tools, and no DMARC at all. That combination reads to a filter as a domain nobody is looking after.

How do I know this is my problem and not the client's IT?

Three signs point at your own domain rather than theirs:

• The same message body goes through fine from a personal Gmail address but lands in spam from your company address.
• It happens to multiple unrelated customers on different mail systems, not just one strict corporate client.
• Invoices sent by your accounting system fail more often than emails typed in your own mailbox. That is the classic signature of a system that sends as your domain without being authorised to.

The check itself takes two minutes with any free online DMARC lookup. If there is no DMARC record, or the policy reads p=none, nothing is being enforced and nobody is reading the reports. That is the gap, and it is also why the problem has been invisible: no bounce message says the word DMARC.

Why has this become stricter?

Gmail and Yahoo set a floor in February 2024 for bulk senders: authenticate with SPF and DKIM, publish DMARC, keep spam complaints low. Microsoft applied comparable requirements to high-volume senders into Outlook.com and Hotmail addresses from May 2025. Those rules formally apply at around 5,000 messages a day, which no fifteen-person firm will reach, so plenty of owners concluded the change did not concern them.

The indirect effect is what matters. Authentication is now the norm, so the small domain without it stands out as the unusual one, and filters weight it accordingly. There is a second reason that has nothing to do with spam folders: a domain with no enforcing DMARC policy can be impersonated by anyone. Invoice fraud, where a buyer receives payment instructions that appear to come from your accounts address, is cheap to attempt and expensive to argue about afterwards. DMARC at reject is the control that closes it.

What does a correct setup look like for a 10 to 20 person company?

The order is the whole job. Doing the same six steps out of sequence is what causes damage.

1. Inventory every system that sends email as your domain. Mailbox provider, accounting or invoicing package, CRM, website forms, booking or quotation tool, newsletter platform, e-signature service. Ten to fifteen entries is typical, and the forgotten one is always the one that breaks later.
2. Publish one SPF record covering all of them. There can only be one, and it is limited to ten DNS lookups, so vendors that each demand an include can quietly push you over the limit and invalidate the lot.
3. Switch on DKIM signing in each platform, not only in the mailbox provider. Most vendors have a two-click option and a pair of DNS records to add.
4. Publish DMARC at p=none with a reports address, then read the reports for two to four weeks. This is the monitoring stage, and it is the only way to find the senders missing from step one.
5. Move to p=quarantine, then to p=reject, once the reports show every legitimate sender passing.
6. Send bulk mail from a subdomain, for example news.yourcompany.com. If a campaign damages your sending reputation, your invoices are not caught in it.

What does it cost, and what can break?

The DNS records themselves cost nothing. DMARC report monitoring runs from a free tier up to roughly SGD 20 to 100 a month depending on volume, and outside help for the full sequence typically lands between SGD 800 and SGD 2,500 as a one-off, because the time goes into the inventory and the report reading rather than the typing.

The real risk is impatience. Jumping straight to p=reject before reading the reports will silently stop legitimate mail from the one system nobody remembered, and it is almost always the accounting package that issues invoices or the website form that delivers enquiries. The failure is not a delay, it is a rejection: those messages never arrive and the sender may never be told. That is the one mistake worth paying someone to avoid.

Who owns this once it is fixed?

One named person, with the DNS login recorded somewhere other than their own laptop. The ongoing duty is small: skim the DMARC reports monthly, and whenever a new tool is signed up that will send email on your behalf, ask the vendor for its SPF include and DKIM keys before go-live rather than after the first failed send. Adding that single line to your tool onboarding checklist is what keeps the fix from decaying over the next two years.

Frequently asked questions

Will fixing DMARC stop my emails going to spam immediately?

It removes the largest single reason a filter distrusts you, and signed, authorised mail usually improves within days. It is not a guarantee on its own. Sending reputation, how recipients have treated your past mail, link shorteners and large attachments all still count. Authentication gets you judged on content instead of being discarded before anyone looks.

Do I need this if we only send twenty emails a day from Gmail?

Yes, for the impersonation reason rather than the spam reason. Volume thresholds govern the bulk sender rules, but anybody can forge mail from an unprotected domain regardless of how little you send. A ten-person firm issuing payment instructions by email has more to lose from a forged invoice than from a slow one.

Can we do this ourselves?

If you hold your own DNS login and administrator access to each platform, the first four steps are reasonable in-house work. Stop at p=none and get help interpreting the reports if the sender list looks unfamiliar, because that is the decision point where a wrong call blocks real mail. Never let a vendor set p=reject on day one.