The short answer: because your domain is probably missing one or more of the three authentication records — SPF, DKIM, and DMARC — that Gmail, Outlook, and Yahoo began enforcing in 2024 and now enforce strictly, with outright rejections for repeat offenders. They're free TXT records at your DNS host, about five minutes each to add, and no email content changes will save you until they exist. Check your domain in seconds with the free email spam checker — it reads your real DNS records and tells you exactly what's missing.
It's the quietest way a local business loses money. You send the quote. Your email says sent. The customer's inbox says nothing — the message is sitting in their junk folder underneath a fake parcel notification. A week later the job's gone to whoever answered first, and you've filed it under "customer changed their mind."
Nothing on your end looks broken, which is exactly why this problem survives for years. So let's make it visible.
What changed — and why it hit small businesses hardest
For decades, email mostly worked on the honour system: any server could claim to send mail as your domain, and receiving servers did their best to sort real from fake. Spam and spoofing eventually broke that. Starting in 2024, Gmail and Yahoo — followed by Microsoft — stopped giving unauthenticated mail the benefit of the doubt. In 2026 the enforcement is fully live: mail from domains that can't prove who they are gets junked by default, and bulk senders who don't comply get rejected outright with an error code.
Big companies had IT departments to handle this. Small businesses had whoever set up the email years ago — often a web host's default configuration that was fine in 2019 and silently fails today. If your email address is you@yourbusiness.ca and nobody has touched your DNS settings in years, you should assume you're affected until you've checked.
The three records, in plain English
All three live as small text (TXT) records in your domain's DNS — the same control panel where your domain name points at your website. No code, no software.
SPF is your approved-senders list. It's one record that says "these services are allowed to send email as my domain" — Google Workspace, Microsoft 365, your invoicing software, your newsletter tool. Mail from anywhere else fails the check. No SPF record means receiving servers can't verify anything claiming to be you — including the real you.
DKIM is the tamper-proof seal. Your email provider signs every outgoing message cryptographically; receivers verify the signature. You don't write this record yourself — you switch it on inside your provider (Google Workspace: Admin console → Apps → Gmail → Authenticate email; Microsoft 365: the Defender portal) and paste the record they generate into your DNS.
DMARC is the policy that ties it together. It tells receivers what to do with mail that fails the other two checks — and, crucially, its mere existence is now part of the baseline. A domain with no DMARC record at all is treated as suspect by Gmail and Outlook regardless of how legitimate the mail is. The starter record is one line — v=DMARC1; p=none; rua=mailto:you@yourdomain.ca — which changes nothing about delivery except satisfying the requirement and sending you reports. Once the reports look clean for a few weeks, tightening the policy to p=quarantine also protects your customers from scammers spoofing your address.
There's a fourth factor worth naming: behaviour. Authentication gets you judged fairly; it doesn't excuse a purchased mailing list, missing unsubscribe links, or a spam-complaint rate above 0.3%. But for a typical local business sending quotes, invoices, and follow-ups, the records are the fix.
How to find out in ten seconds
I built a free email spam checker that does the lookup live: enter your domain (or just your business email address) and it reads your actual public DNS records — MX, SPF, DMARC, and a best-effort DKIM probe — and explains each result in plain English. It runs in your browser, touches nothing, sends no email. If something's missing, the fix guide gives you the exact record text to add, written so you can forward it to whoever manages your domain.
A note on that "whoever": for most BC small businesses the domain lives at GoDaddy, Namecheap, or the web host, and the login lives with a designer who built the site years ago. Tracking down that access is annoying — and worth doing this week rather than during a dispute. It's the same lesson as the wildfire checklist: control of your own accounts is infrastructure.
The bigger picture: email you send on purpose
Once your domain authenticates, your email is an asset again — and most local businesses under-use it badly. The quote follow-up that goes out automatically two days later. The reminder before the seasonal service. The once-a-month note to past customers that keeps you the first name they think of. That layer — deliverability, follow-ups, and newsletters that actually get read — is what email marketing for Kamloops businesses covers. And if the deeper problem is that enquiries fall through cracks in general, run the numbers on the missed call calculator — email in junk and calls unreturned are the same leak in two places.
But first: check the records. It's ten seconds, it's free, and "I never got your quote" is the most expensive sentence in local business.