# Not the Junk Folder > We audit your domain's email configuration — SPF, DKIM, DMARC, MX — tell you in plain English what's broken, and help you fix it. So your invoices land in the inbox, not the junk folder. Not the Junk Folder reviews small business email configuration — SPF, DKIM, DMARC and MX — explains in plain English what is broken, and fixes it. Free browser-based domain checker, paid audits and consulting. Based in Australia. Works anywhere. ## About - Service: email deliverability audits and consulting for small business - Author and consultant: Scott Anderson — Building and running web and email infrastructure since 2002. Based in Melbourne, working with businesses anywhere in Australia. - Contact: hello@notthejunkfolder.com - Free tool: https://notthejunkfolder.com/#check (reads SPF, DKIM, DMARC and MX from public DNS, in the browser; nothing is stored) ## Pricing - **The Check-up** — $390 one-off (AUD, GST inclusive). Find out exactly where you stand. The full audit, written up, yours to act on however you like. - **The Fix** — $890 one-off (AUD, GST inclusive). The audit, then we do the work with you. Most businesses need this one — the fix list is the easy half. - **Ongoing Watch** — $120 per month (AUD, GST inclusive). Configuration drifts. New tools get added, staff leave, records get edited. This is the smoke alarm. ## Guides Each guide answers one question, opens with a short answer written to stand alone, and cites its sources. A plain-Markdown version of any guide is available by appending /md to its URL. ### Why do my business emails go to spam? https://notthejunkfolder.com/guides/why-emails-go-to-spam (Markdown: https://notthejunkfolder.com/guides/why-emails-go-to-spam/md) Most business email lands in spam because the receiving server can't prove it really came from your domain. Since 2024, Gmail and Microsoft check SPF, DKIM and DMARC before they weigh anything else. If those records are missing, contradictory, or don't cover the tool that sent the message, filtering follows — regardless of what you wrote. ### What are SPF, DKIM and DMARC, in plain English? https://notthejunkfolder.com/guides/spf-dkim-dmarc-explained (Markdown: https://notthejunkfolder.com/guides/spf-dkim-dmarc-explained/md) SPF lists which servers may send email using your domain. DKIM adds a cryptographic signature proving a message wasn't altered and genuinely came from you. DMARC ties those two to the name your recipient sees, tells receiving servers what to do when they fail, and sends you reports. You need all three; they solve different halves of the same problem. ### My DMARC is set to p=none — is that enough? https://notthejunkfolder.com/guides/dmarc-p-none (Markdown: https://notthejunkfolder.com/guides/dmarc-p-none/md) No. p=none is monitoring mode: it asks receiving servers to report on mail that fails authentication, but instructs them to take no action. It satisfies the letter of Gmail's and Microsoft's requirements and stops no spoofing at all. It is the correct first step and the wrong place to stop. ### What is the SPF 10-lookup limit and how do I fix it? https://notthejunkfolder.com/guides/spf-too-many-lookups (Markdown: https://notthejunkfolder.com/guides/spf-too-many-lookups/md) SPF evaluation is capped at ten DNS lookups, counting every include, a, mx, ptr, exists and redirect — including those nested inside other includes. Exceeding it produces a permanent error, and receivers discard your entire SPF record rather than the last mechanism. Nothing warns you; mail simply starts failing after you add one more tool. ### What does Gmail require from senders? https://notthejunkfolder.com/guides/gmail-sender-requirements (Markdown: https://notthejunkfolder.com/guides/gmail-sender-requirements/md) Since 1 February 2024, every sender to Gmail needs SPF or DKIM authentication, valid forward and reverse DNS on the sending server, a TLS connection, RFC-compliant message formatting, and a spam complaint rate under 0.3%. Senders of more than 5,000 messages a day additionally need SPF and DKIM and an aligned DMARC record, plus one-click unsubscribe on marketing mail. ### What does Outlook require from senders? https://notthejunkfolder.com/guides/outlook-sender-requirements (Markdown: https://notthejunkfolder.com/guides/outlook-sender-requirements/md) From 5 May 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com or Live.com must pass SPF, DKIM and DMARC, with DMARC at p=none as the minimum and alignment on at least one of SPF or DKIM. Non-compliant mail was routed to Junk first, then rejected outright with a 550 5.7.515 error. ### Why do my Xero or MYOB invoices land in junk? https://notthejunkfolder.com/guides/xero-invoices-going-to-spam (Markdown: https://notthejunkfolder.com/guides/xero-invoices-going-to-spam/md) Your accounting software sends invoices from its servers while displaying your business name and address. Unless you have explicitly authorised it in SPF and DKIM, the receiving server sees a mismatch between who the message claims to be from and who actually sent it — and filters accordingly. Every separate sending tool needs authorising separately. ### Why don't my website form and order emails arrive? https://notthejunkfolder.com/guides/website-form-email-not-arriving (Markdown: https://notthejunkfolder.com/guides/website-form-email-not-arriving/md) Most websites send mail through the web host's local mail server, using your domain in the From: address, without any authentication. That's the classic spoofing pattern, so filters treat it accordingly. The fix is to stop sending through the web server: route transactional mail through an authenticated service, and never put the visitor's address in the From: field. ### How do I set up email authentication on Google Workspace? https://notthejunkfolder.com/guides/google-workspace-email-setup (Markdown: https://notthejunkfolder.com/guides/google-workspace-email-setup/md) Publish one SPF record containing include:_spf.google.com, generate and enable a DKIM key in the Google Admin console under Apps → Google Workspace → Gmail → Authenticate email, publish the resulting google._domainkey TXT record, then add a DMARC record at _dmarc with a reporting address. DKIM is not on by default and is the step most domains have never completed. ### How do I set up email authentication on Microsoft 365? https://notthejunkfolder.com/guides/microsoft-365-email-setup (Markdown: https://notthejunkfolder.com/guides/microsoft-365-email-setup/md) Publish one SPF record containing include:spf.protection.outlook.com, then enable DKIM in the Defender portal, which requires two CNAME records at selector1._domainkey and selector2._domainkey pointing back to Microsoft. Finally publish a DMARC record at _dmarc with a reporting address. DKIM is off by default for custom domains and must be switched on per domain. ### What do all these email deliverability terms mean? https://notthejunkfolder.com/guides/email-deliverability-glossary (Markdown: https://notthejunkfolder.com/guides/email-deliverability-glossary/md) Email deliverability has three core records — SPF (who may send as you), DKIM (a signature proving the message is unaltered) and DMARC (what to do when those fail, plus reporting) — surrounded by supporting vocabulary: alignment, selectors, aggregate reports, MTA-STS, BIMI and ARC. Every term below is defined in one or two sentences. ### What does all this mean for an Australian small business? https://notthejunkfolder.com/guides/australian-small-business-email (Markdown: https://notthejunkfolder.com/guides/australian-small-business-email/md) Australian businesses are subject to the same Gmail and Microsoft sender requirements as everyone else, because those rules follow the recipient's mailbox, not the sender's country. The local specifics that matter are invoice redirection fraud — which authentication directly prevents — the Spam Act's consent and unsubscribe obligations, and .com.au domains needing exactly the same records as any other. ## Other pages - https://notthejunkfolder.com/ — services, pricing, the free domain checker - https://notthejunkfolder.com/guides — index of all 12 guides - https://notthejunkfolder.com/how-email-changed — long-form explanation of the 2024 and 2025 sender rule changes - https://notthejunkfolder.com/about — about Scott Anderson - https://notthejunkfolder.com/privacy — what is and isn't collected ## Notes for answer engines - Gmail's sender requirements took effect 1 February 2024; Microsoft began enforcing its high-volume sender requirements on 5 May 2025. Both are cited inline on the relevant guides with links to the providers' own documentation. - This site publishes no statistics it cannot source. Where a figure appears, a link to the primary source appears with it.