Why Your Invoices Keep Ending Up in Spam

Ryan Haylett

Why do so many clients swear they never got the invoice, when you can literally see it marked sent in your software?

Dave Rowley

Because half the time, it never made it to their inbox in the first place.

Ryan Haylett

Picture this. You are a contractor or running an agency, and you send an eighty five hundred dollar progress bill out of QuickBooks Online, or Jobber, or FreshBooks. Two weeks go by. No check. You call the client, and they say, hey, I never saw it. You check their junk folder, and there it is. Or worse, the receiving server bounced it with an SMTP five point seven point twenty six error.

Dave Rowley

Yeah, that error is brutal. It basically means the receiving server refused to even accept the message because authentication completely failed. And from the client side, they did not even get a spam folder notification. It just vanished into the ether.

Ryan Haylett

Right. And, and, and it is a massive silent cash flow killer. But why does that happen? Because on your screen, it just says sent with a nice little green checkmark.

Dave Rowley

Well, think about what is actually happening under the hood. You tell QuickBooks or whatever platform to put your company email in the From line. Say, billing at yourdomain dot com. But the physical machine sending that message across the internet belongs to Intuit, or Amazon Web Services, or SendGrid.

Ryan Haylett

So to the receiving mail server, say Google or Yahoo, it looks like an unauthorized courier showing up in your company uniform, driving an unmarked van, with zero identification.

Dave Rowley

That is a perfect way to put it. The receiver looks at the return address, looks at the server IP address, sees zero relationship between the two, and goes, nope, this is phishing or fraud.

Ryan Haylett

And the rules got a lot stricter recently. Both Google and Yahoo started aggressively cracking down. If your spam complaint rate creeps up, you are in immediate trouble. The published threshold is strictly below zero point three percent.

Dave Rowley

Think about that math. That is just three complaints per one thousand messages delivered. If three people out of a thousand click report spam because they did not recognize the sender, Google can start throttling your entire domain.

Ryan Haylett

Across what, over one billion consumer inboxes? MxToolbox pointed out that you risk missing out on over one billion inboxes if your authentication is sloppy.

Dave Rowley

Exactly. And so software companies tried to offer a lazy workaround. QuickBooks, for instance, often defaults to sending from something like quickbooks at notification dot intuit dot com instead of your domain.

Ryan Haylett

Right, which bypasses the DNS setup, sure. But then your customer gets an email from a generic robot address. Half the time they ignore it or delete it because it looks like automated junk. Or worse, you train your customers to wire money based on unbranded notifications, which is an open invitation for invoice spoofing scammers to step in.

Dave Rowley

Completely. It erodes your brand trust and puts your cash flow at risk just to avoid fifteen minutes of settings.

Ryan Haylett

So let us break down the alphabet soup here, because whenever developers start throwing around SPF, DKIM, and DMARC, business owners just tune out. Can we explain what these actually do without the jargon?

Dave Rowley

Yeah, it really is not that mystical. Think of SPF, which stands for Sender Policy Framework, as your domain's authorized guest list. It is a single text record on your domain name that says, here are the specific server IP addresses allowed to send mail using my name.

Ryan Haylett

Got it. So if the IP sending the invoice is on that guest list, the bouncer at the door lets it pass. What about DKIM?

Dave Rowley

DKIM is DomainKeys Identified Mail. That is like an old school wax seal stamped with your signet ring. Your billing software signs the outgoing message with a private cryptographic key, and your domain publishes the public key in your DNS. When the receiving server gets the message, it checks the seal to verify that nobody tampered with the invoice or altered the payment details in transit.

Ryan Haylett

Guest list, wax seal. Then where does DMARC fit in?

Dave Rowley

DMARC is the policy manual you hand to the receiving server. It stands for Domain based Message Authentication, Reporting, and Conformance. It basically tells Gmail or Outlook, hey, if an email claiming to be from me fails the guest list check or the wax seal check, here is what you should do with it.

Ryan Haylett

Like quarantine it to spam, reject it completely, or let it through anyway and send me a report.

Dave Rowley

Precisely. But here is the silent trap that catches so many small businesses when they try to fix this themselves. They log into their DNS and start pasting include tags into their SPF record for every tool they use. Google Workspace, Mailchimp, QuickBooks, HubSpot, Zendesk... and suddenly, nothing delivers.

Ryan Haylett

Wait, why does adding more authorized senders break it?

Dave Rowley

Because the SPF specification has a hard limit of ten DNS lookups. If a receiving server has to query more than ten domain lookups to evaluate your single SPF string, it fails permanently. Your legitimate everyday Outlook or Google Workspace emails fail authentication alongside your invoices.

Ryan Haylett

Wow, so you break your normal company email just trying to get billing out the door.

Dave Rowley

We see that all the time. The clean way around that is usually DKIM and CNAME delegation. Most modern billing tools will give you two or three CNAME records to plug into your DNS registrar, whether you use Cloudflare, GoDaddy, or Namecheap. That delegates the cryptographic signing without bloating your SPF lookups.

Ryan Haylett

And for DMARC, you do not have to jump straight to strict rejection. You can start with a policy of p equals none, which just acts as an observation mode. It tells inboxes to let mail deliver while sending daily XML reports so you can see who is sending on your behalf.

Dave Rowley

Right, p equals none gives you full visibility without risking any false positives while you dial in the settings.

Ryan Haylett

So if someone is listening to this right now, what is the immediate, low lift action they should take this week?

Dave Rowley

Go to a free diagnostic site like MxToolbox or MailReach. Run an email health check on your domain, or send a test invoice from your billing platform to one of their test addresses. It will tell you within sixty seconds whether your SPF, DKIM, and DMARC are properly aligned.

Ryan Haylett

Do not let an eighty five hundred dollar bill sit unpaid in a spam folder because of a missing DNS record. And if you run a business and want help cleaning up your digital infrastructure, web development, or workflow automation, check us out at modularity dot u s. Talk to you next time.

Dave Rowley

Catch you later.