A plumbing company sends an estimate on a Tuesday morning. The Sent folder says it went. Two weeks later the customer calls a different plumber, because as far as she knows, nobody ever sent her anything.
Nothing errored. No bounce message came back. No warning appeared anywhere. The estimate arrived at her mailbox and was filed into spam, where she never looked.
That is the quietest way a small business loses work. Not a crash, not a hack. Just mail that lands one folder to the left of where it needed to be.
Nothing on your end will tell you
A bounced email is loud. You get a message back within seconds telling you the address doesn't exist. Filtered email is silent by design. The receiving server accepts your message, decides it looks suspicious, and puts it in the junk folder. From your side, everything worked.
This is why the problem runs for months before anyone notices. You have no record of the calls that never came.
The rules changed, and they apply below 5,000 emails a day
Google's own sender guidelines say that since February 1, 2024, all senders emailing personal Gmail accounts must set up SPF or DKIM authentication for their domain. Only senders above 5,000 messages a day are also required to have DMARC.
Most small businesses read the 5,000 number, decide it isn't them, and stop reading. But the first requirement has no volume threshold at all. A twelve-person shop sending six estimates a week is covered by it.
Google's FAQ adds that starting November 2025 it began ramping up enforcement on non-compliant traffic, with messages that fail those requirements seeing temporary and permanent rejections. For a business, the practical version is simpler than the policy: a growing share of receiving mailboxes now decide whether to trust you based on records you may never have looked at.
Three records, in a place you probably don't control
SPF is a text record in your domain's DNS that lists the servers allowed to send mail as your domain. DKIM is a signature attached to each message, so the receiving side can tell it wasn't altered in transit. DMARC tells the receiver what to do when the first two fail, and where to send reports about it.
Microsoft's documentation is blunt about the relationship: these are interdependent, and using anything less than all of them leaves you with weaker protection than you think you have. SPF alone is not enough.
Here is the part that actually stops people. Those records live in DNS, and DNS lives wherever your domain is registered or hosted. In a lot of small businesses, nobody currently employed knows the login for that account. The records may be half set up, or set up years ago by a website person who is no longer reachable. You cannot fix email authentication without first answering the question of who controls the domain, and that question is often the whole project.
What it costs, in plain terms
The first cost is work that never lands. Estimates that go unanswered. Invoices that get paid late because the reminder sat in a junk folder. A schedule change nobody received.
The second cost is worse, because it's reputational. Your customer doesn't conclude that Gmail misfiled you. She concludes that you didn't bother to reply. You never get the chance to explain.
There's also a version of this that runs the other direction. A domain without DMARC gives a spammer a free hand to send mail that says it's from you, and no receiving server has been told to reject it. That is worth fixing, but it isn't the reason most small businesses should care. The reason is the estimate that arrived in September and was never read.
What good looks like
Someone can tell you, without guessing, whether all three records exist on your domain, and can show you the answer. A DNS lookup settles it in about a minute.
You have sent a test message to a personal Gmail address you control, opened the full headers, and found the Authentication-Results line. You want to see spf=pass, dkim=pass, and dmarc=pass against your own domain, not against some default domain the provider issued you.
Every system that sends mail as you is accounted for. The website contact form, the scanner in the back office, the invoicing software, the newsletter tool. This is the reason so many domains sit at a DMARC policy of none, which means report only and enforce nothing. It's a reasonable place to start. It is not a place to stay.
The DMARC reports go to an address a person actually reads. Those reports tell you who is sending as your domain, including the thing you forgot you signed up for.
And it gets checked again when something changes. New form on the website. New email provider. New employee with a signature block. This is the part that makes it managed rather than fixed. Email authentication isn't a setting you turn on once. It's a small piece of your infrastructure that other people keep changing.
One honest caveat, because it matters. Passing authentication does not put you in the inbox. It removes one large, common reason to be filtered and it makes it much harder for someone to impersonate you. Content, sending history, and the recipient's own settings still decide the rest.
You can check the first two items on that list yourself this week. If you'd rather someone just told you where you stand, that's a conversation we're glad to have.