Why Your Invoices Vanish: SPF, DKIM, and DMARC Fixes

Ryan Haylett

So, I- I- I was talking to this contractor last week. Local guy, does great work, but he was literally tearing his hair out because he had about twelve grand in outstanding invoices just sitting there. And when he finally called the clients, every single one of them said the exact same thing: "Oh, I- I never got the invoice."

Dave Rowley

Let me guess. They weren't actually dodging him. The emails just straight up vanished into the digital ether.

Ryan Haylett

Exactly! They weren't even in the spam folder. They were just, like, blocked at the gateway. And look, it's not like there was a single, sudden vendor switch flipped overnight. Major providers like Google and Yahoo have been progressively tightening email authentication and filtering for years. But between recent enforcement windows and a mix of factors—like your authentication, sending reputation, content, and volume patterns—your deliverability can quietly plummet. Suddenly, automated emails from QuickBooks or Jobber just get vaporized. It's a massive, silent cash flow killer.

Dave Rowley

It's wild because business owners think, "Well, I- I pay for QuickBooks, so obviously QuickBooks knows how to send an email." But from the perspective of Google or Yahoo, when QuickBooks sends an invoice showing your email address, say, jim@jimsplumbing.com, but it originates from an Intuit server... that looks exactly like a phishing scam. It's like someone trying to cash a check with your name on it but using a photocopy of your ID.

Ryan Haylett

Right! It's- it's identity theft in the eyes of the spam filter. And the mail servers don't take risks anymore. They just drop the message. No bounce-back, no warning. Just... gone.

Dave Rowley

We should probably explain how the mail servers actually verify this, because it sounds like alphabet soup to most people—you know, SPF, DKIM, DMARC. But it's actually pretty simple if you think of it like physical mail security. SPF, or Sender Policy Framework, is basically just an authorized guest list for your domain. It's a text record on your domain name that says, "Hey, I allow QuickBooks, Calendly, and Housecall Pro to send mail using my name." If a server gets an email from QuickBooks claiming to be you, it checks the list. If QuickBooks isn't on it, boom—denied.

Ryan Haylett

Okay, that makes sense. So SPF is the guest list. But what about DKIM? That's the... the cryptographic signature thing, right?

Dave Rowley

Exactly. Think of DKIM as a holographic wax seal on the envelope. It's a digital signature that proves the email wasn't tampered with mid-transit. The receiving server uses a public key—which, again, lives in your domain's DNS settings—to verify that the seal is authentic. If the seal is broken, or if there is no seal at all, the server gets suspicious.

Ryan Haylett

So we've got the guest list and the holographic wax seal. Where does DMARC fit in? Because that's the one that usually throws people off.

Dave Rowley

DMARC is the security bouncer standing at the door. It looks at the guest list—the SPF—and the wax seal—the DKIM—and it tells the receiving server exactly what to do if those two things don't match up. You can tell the bouncer to just monitor things, or you can tell them to actively reject any message that fails verification and throw it straight into the garbage.

Ryan Haylett

And the problem is, if you're running a service business, you aren't just sending emails from your Outlook or Gmail inbox. You've got Jobber sending dispatch notifications, Calendly sending booking confirmations, Stripe sending receipts, maybe HubSpot sending newsletters. If even one of those tools is unauthenticated, your booking no-show rates skyrocket because people literally don't know they have an appointment. And then you're sitting there wondering why your schedule is empty and your bills aren't paid.

Dave Rowley

It's a nightmare, but the good news is it is entirely fixable. It doesn't take weeks. You just need to be methodical. The first step is literally just writing down every single tool you use that sends mail. Don't guess. Go through your bank statements if you have to. QuickBooks, Housecall Pro, Mailchimp, active campaign—get them all on one list.

Ryan Haylett

Right, because if you miss one, that's the one that's going to keep failing. And once you have that list, you have to actually log into your domain registrar, or where your DNS points to—you know, GoDaddy, Namecheap, Cloudflare, us at ModularityHosting.com, wherever you bought your domain name—and update those DNS records.

Dave Rowley

Yes. Every one of those tools will have a settings page, usually under "Domain Verification" or "Email Settings," that gives you the exact TXT records you need to copy and paste. You're basically adding their specific mail servers to your SPF guest list and generating that DKIM key for them to sign their emails.

Ryan Haylett

So, what are some quick wins people can actually do, like, this week to make sure they aren't leaking cash?

Dave Rowley

First, do a real-world test. Send an invoice or a booking confirmation directly from your software to a personal Gmail or Yahoo account. Don't use your work email, because your work server already trusts you. Use a completely external, free account. Did it go to the inbox? Did it land in spam? Or did it not show up at all? That's your baseline.

Ryan Haylett

And what if it does land in spam, or doesn't show up? Is there an easy way to see *why* it failed without digging through raw email headers?

Dave Rowley

Oh, absolutely. There are free tools like MXToolbox or mail-tester.com. You just send a test email to a unique address they provide, and it gives you a simple, color-coded report card. Red, yellow, green. It'll tell you exactly if your SPF is missing, or if your DKIM signature is invalid.

Ryan Haylett

That's huge. And, you know, another quick win—especially if you're on Google Workspace or Microsoft 365—is to check if your software allows for a direct OAuth connection. Some billing and booking platforms let you log directly into your Microsoft or Google account through their settings. When you do that, the software actually sends the email *through* your real inbox server, rather than on behalf of it. It completely bypasses the whole third-party authentication headache because it's genuinely coming from your official account.

Dave Rowley

Yes! If that option is available, use it. It's a total cheat code for small business owners who don't want to mess around with DNS records.

Ryan Haylett

Look, your domain reputation is a physical asset. If your domain gets blacklisted because of bad security settings, it can take months to repair that trust with Google and Yahoo. It's just not worth the risk when the fix is right there. If this sounds like a foreign language, or you just don't want to risk breaking your email, go to modularity.us. We handle this exact setup for businesses every single day to make sure your invoices actually hit the inbox and you actually get paid. Let's make sure your cash flow isn't leaking through a dumb domain setting.

Dave Rowley

Definitely. Alright, let's get back to work.