Are Your Quotes Going to Spam? We Checked the Email Records of 1,527 Contractor Domains. 1 in 10 Skip What Gmail Requires.

Gmail has a rule for anyone who sends it email, and it isn't only for companies blasting out newsletters. Since February 1, 2024, every sender is supposed to publish at least one of two records, called SPF and DKIM, that let Gmail check a message really came from them. Yahoo sets the same floor. Google's own FAQ says that starting November 2025, Gmail is “ramping up its enforcement on non-compliant traffic,” with “temporary and permanent rejections.”

Your quotes, invoices and follow-up emails are all traffic. So we checked contractors. On October 18, 2026 we looked up the email records of 1,527 contractor domains in the US and Canada.

147 of them (9.6 percent, about 1 in 10) publish neither record. Among companies whose email runs on Google Workspace, 1 in 5 publish nothing that authorizes Google to send their mail. And 1,258 (82.4 percent) don't tell inboxes what to do with a fake email sent in their name.

Below: what the three records do in plain English, what Gmail and Yahoo actually require, what we found, and how to check your own domain in about five minutes.

What We Checked, and What Email Records Can't Tell You

We ran 96 Google Places API text searches: six trades (roofing contractor, HVAC company, plumber, electrician, general contractor, landscaping company) in 16 cities. In the US: Phoenix, Dallas, Atlanta, Denver, Chicago, Charlotte, Seattle, Tampa, Columbus and Nashville. In Canada: Toronto, Vancouver, Calgary, Edmonton, Ottawa and Winnipeg. We took the top 20 results each time, with service-area businesses included. That gave 1,920 result spots and 1,852 different businesses.

1,870 of those spots linked to the business's own website (44 had no website, 6 linked to a Facebook page or similar). Franchises and companies that showed up for more than one trade share a domain, so that came down to 1,718 unique domains. 1,527 of them have a mail server record, which means the company gets email at that domain and almost certainly sends from it too. That's our base for every percentage below: 956 in the US, 571 in Canada. The other 191 website domains don't handle email at all.

For each domain we read its public DNS records through Google Public DNS and spot-checked a sample against a second lookup service. There are three records that matter:

• SPF is a list of the mail servers allowed to send email as your domain.
• DKIM is a digital signature your mail service adds to each message. The inbox checks it against a key you publish.
• DMARC tells the inbox what to do with a message that claims to be from you but fails both checks: deliver it anyway (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It can also send you reports.

Know the limits before you read the results:

• We read records, not mail. We sent no test messages, so we can't tell you that any particular email went to spam.
• Our DKIM numbers are a floor. A DKIM key sits at a name the sender picks. We checked 16 common ones, so “no DKIM key found” means none at those 16. A domain could have one somewhere else.
• Some SPF errors only bite part of the time. Two of the three SPF mistakes below only cause a failure when a checker reaches that part of the record.
• It's one day and Google's top 20. These are mostly established companies, not every contractor in those cities.

Gmail and Yahoo Set One Rule for Every Sender, Not Just Big Ones

Google's Email sender guidelines put it plainly: “Starting February 1, 2024, all email senders who send email to Gmail accounts must meet the requirements in this section.” The first requirement on that list is “Set up SPF or DKIM email authentication for your sending domains.” If you send more than 5,000 messages a day, you need SPF, DKIM and DMARC. Everyone else needs at least one of the first two.

Paying for Google Workspace doesn't exempt you. Google's sender guidelines FAQ says: “All senders, including Google Workspace users, must meet the requirements in our Email sender guidelines when sending messages to personal Gmail accounts.” Yahoo's sender requirements list the same floor for all senders: “Implement SPF or DKIM at a minimum.”

Here's the honest part. Most of the enforcement detail in Google's FAQ is written about bulk senders. Google doesn't publish what happens to one quote from a small contractor that fails the check, and we didn't test it. What Google does say is that authenticated messages “are less likely to be rejected or marked as spam by Gmail.” If you're emailing quotes to homeowners with Gmail addresses, that's the rule your email is being measured against.

1 in 10 Contractor Domains Publish Neither Record. On Google Workspace, 1 in 5 Never Authorized Google.

147 of the 1,527 domains (9.6 percent) have no SPF record (139 of them) or two SPF records that cancel each other out (8), and no DKIM key at any of the 16 places we looked. By Gmail's and Yahoo's written rules, there's nothing for the inbox to check.

It depends a lot on who runs the mailbox:

Google Workspace is the biggest group, at 606 domains. 118 of them (19.5 percent) have no SPF record at all. Only 394 (65.0 percent) have an SPF record that names Google, and only 185 (30.5 percent) have published Google's DKIM key. Put together, 127 of the 606 (21.0 percent) publish nothing that tells an inbox Google is allowed to send their mail. The same test on Microsoft 365 catches 9 of 437 (2.1 percent).

On Google Workspace, DKIM for your own domain is a setup step. Google's DKIM setup page has you generate a key in the Admin console and add it at your domain provider. If nobody did that step, and nobody added Google to an SPF record either, your Workspace mail goes out with nothing for Gmail to check.

A bigger company doesn't fix this one. The share publishing neither record is 10.3 percent for companies with 0 to 49 Google reviews and 8.1 percent for those with 1,000 or more. It's 9.4 percent in the US and 10.0 percent in Canada.

Another 76 Have an SPF Record That Breaks the Standard's Own Rules

Having an SPF record isn't the same as having one that works. SPF is defined in RFC 7208, and it has three rules people trip over:

• One SPF record per domain. If there are two or more, the standard says the check “produces the ‘permerror’ result,” every time. 19 domains have two or more.
• Every “include” has to point at a real SPF record. An include that leads nowhere is also a permanent error when a checker reaches it. 35 domains have one.
• No more than 10 DNS lookups. Past that, the standard says the checker “MUST return ‘permerror’.” 23 domains go over.

That's 76 domains (5.0 percent), since a few have more than one problem. The patterns repeat. Someone adds a second SPF record for a newsletter or email-sending service instead of merging it into the first one. An SPF record names a web host while the company's email actually runs on Google. A typo like spf.google.com where Google's address is _spf.google.com. One record has an invisible character hidden inside it. And one domain ends its record in +all, which tells the world that any server on the internet may send email as that company.

Add those to the domains with no SPF record at all and 247 of 1,527 (16.2 percent) don't have a working SPF record. That isn't automatically fatal. Gmail asks for SPF or DKIM, so a domain with a broken SPF record and working DKIM still meets the floor. That's why the 1 in 10 number above counts only domains with neither.

8 in 10 Don't Tell Inboxes What to Do With Fakes Sent in Their Name

648 domains (42.4 percent) have no DMARC record. Another 603 (39.5 percent) have one set to p=none, which means monitor only. 7 publish two DMARC records, which doesn't count. Together that's 1,258 (82.4 percent) giving inboxes no instruction to junk or refuse mail that fails the checks while claiming to be from them.

Only 269 (17.6 percent) enforce: 169 send failures to spam and 100 refuse them. Just 198 (13.0 percent) have all three pieces in place with an enforcing policy.

p=none is meant to be a starting point. Google's DMARC setup page recommends starting with the policy at none, then says: “As you learn how messages from your domain are authenticated by receiving servers, update your policy.” Over time, that means quarantine, then reject. When the US government ordered its own agencies to set up DMARC in Binding Operational Directive 18-01, it called p=none “a temporary policy setting before getting to p=quarantine and p=reject.”

Company size makes a real difference on this one:

Companies with 1,000 or more reviews are more than twice as likely to enforce DMARC as the smaller groups. The top 3 results in each search enforce at 22.7 percent, against 15.7 percent for spots 11 to 20. That's a size pattern, since bigger firms are more likely to have someone handling IT. It isn't proof that email settings move your ranking, and we have no evidence that they do.

Why a contractor should care: homeowners send you deposits. An email that looks like it came from your address, telling a customer to send the deposit to a new account, is an old trick. An enforcing DMARC policy tells Gmail, Outlook and Yahoo to junk or refuse mail that uses your exact domain and fails the checks.

Here's what DMARC doesn't do. It doesn't help if a crook gets into your real mailbox, registers a look-alike domain, or opens a free Gmail account under your company name. The FBI's 2025 Internet Crime Report counted 24,768 business email compromise complaints and $3,046,598,558 in reported losses in 2025. The FBI describes those scams as carried out “by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications.” So most of that money moved through hacked or tricked accounts, which DMARC doesn't stop. Turn on two-step login for your mailbox, and call to confirm any change in payment details using a number you already have.

There's an opposite mistake, too. 6 domains tell inboxes to junk or refuse mail that fails the checks, while publishing no SPF record and no DKIM key we could find. Unless they sign somewhere we didn't look, they've told inboxes to junk or refuse their own email. Google warns about exactly this: “If you don't set up SPF and/or DKIM before enabling DMARC, messages sent from your domain will probably have delivery issues.”

And 191 of the website domains don't handle email at all. 143 of those have no DMARC record, 12 have one set to reject, and 5 have the SPF record that says no server may send for them. A domain you never email from can still be faked. The UK's National Cyber Security Centre recipe for parked domains, written for government but fine for anyone, is three records: SPF with no senders allowed, DMARC set to reject, and a “null MX” that refuses incoming mail.

How to Check Your Own Domain in Five Minutes, and the Order to Fix It

1. List everything that sends email as your address. Your mailbox (Google Workspace, Microsoft 365 or your web host), your website's form notifications, your quoting or invoicing software, your newsletter tool and your CRM. For each tool, ask whether it sends from its own address with your name on it, or from your address. Only the second kind needs your records.
2. Look up what you publish. Free lookup tools will show the SPF and DMARC records for any domain. Type your domain (yourcompany.com), not your email address.
3. Fix SPF first. One record that names every service from step 1. Merge new services into it and never add a second record. Take out services you've stopped using, and stay under 10 lookups.
4. Turn on DKIM. Switch it on inside your mail service and publish the key it gives you at your DNS host. For Google Workspace, Google's DKIM setup page walks through it.
5. Add DMARC at p=none with a report address. Google says to allow 48 hours after setting up SPF or DKIM before you add DMARC. Read the reports for a few weeks. When your own tools pass, move to p=quarantine, then p=reject.
6. Lock domains you don't email from. SPF with no senders, DMARC set to reject, and a null MX, per the recipe above.

If your business email is a free @gmail.com or @outlook.com address, none of this is yours to set. Google and Microsoft handle the records for their own domains. Our check only covered businesses with their own domain.

The person who makes these changes is whoever controls your domain's DNS. That's usually whoever set up your website or your email. If you don't know who that is, that's its own problem, and our 7-asset ownership check covers it. Our website design service lists DNS setup as part of the build, and these three records live in the same place. And once your quotes are reaching the inbox, the next step is a follow-up system that turns them into signed jobs.

How we did this: On October 18, 2026 we ran 96 Google Places API text searches (6 trades, 10 US and 6 Canadian cities, top 20 each, service-area businesses included), took the 1,718 unique business domains, and read each one's MX, SPF, DMARC and DKIM records (16 common selectors) through Google Public DNS. We followed every SPF include to count lookups and find dead ones. 1,527 domains have a mail server and are the base for every percentage. We didn't send any email, and we haven't named any business.

Frequently Asked Questions