Your quotes are going to spam: the 2026 fix.
If customers go quiet after you send a quote, there is a good chance it never reached them. Here is why Google and Microsoft now filter unauthenticated email so hard, a five-minute check, the fix, and the link to whether AI tools trust your business.
- Google, Yahoo and Microsoft now check three domain records on every message, and unauthenticated email is far more likely to be filtered or rejected.
- Asbestos quotes are hit hardest: they go to corporate inboxes and look like the invoice fraud those filters exist to catch.
- A five-minute test in Gmail shows whether your quotes pass the SPF, DKIM and DMARC checks.
- The fix is three records on your domain, covering every service that sends email for you, tested again after every change.
- Email trust and AI trust rest on the same thing: a domain and website that can be verified.
Here is a pattern we see more often than any other when asbestos contractors tell us "enquiries have gone quiet". The surveys are done, the quotes are typed up and sent, and then nothing. The customer never replies. A week later the job turns up on a competitor's van. When the contractor finally rings the customer, they hear the words every business owner dreads: "I never got your email."
They did get it. It went into spam. Since 2024, Google, Yahoo and Microsoft have been tightening the rules on which email they trust, and enforcement has stepped up through 2025 and 2026. In 2026, even low-volume business senders feel the impact: without the right technical records on your domain, your quotes, invoices and survey confirmations are far more likely to be flagged. This guide explains why it happens, how to check your own firm in five minutes, how to fix it, and why it connects to a bigger question about whether your business can be trusted online at all.
What changed, in plain English
Email was designed in an era when anyone could send a message claiming to be from anyone. To stop fraud, the big email providers now check three things about every message that arrives from your domain:
- Is the sending service allowed to send for this domain? That is a record called SPF.
- Was the message signed by the domain and not altered on the way? That is DKIM.
- Does the domain publish a policy saying what to do if either check fails? That is DMARC.
Google's sender guidelines require at least SPF or DKIM from every sender, and both, plus a DMARC record, from anyone sending in volume. Microsoft's Outlook services began enforcing the same requirements for high-volume senders in May 2025, and messages that fail may be rejected outright rather than simply filtered. A typical asbestos firm sends nowhere near the "bulk" threshold of 5,000 messages a day, but the same checks run on every message, and a domain with none of the records set up is now treated with suspicion whether it sends ten emails a day or ten thousand.
Why asbestos firms are hit harder than most
Three things about the way asbestos work is bought make this worse for you than for, say, a florist.
- Your quotes go to corporate inboxes. Facilities managers, housing associations, schools and principal contractors sit behind Microsoft 365 or Google Workspace with security settings turned up high. A quote from an unauthenticated domain is exactly what those filters are built to catch.
- Your emails look like the fraud they are trying to stop. A message with a price, a PDF attachment, bank details and a request to confirm is the shape of an invoice scam. Without authentication, filters have no way to tell your real quote from a fake one.
- You often send from several places at once. The office uses Microsoft 365, the surveyor's software sends reports, the accounts package sends invoices and someone still has the old hosting webmail. Every one of those must be authorised in your records, or the messages from the missing service quietly fail.
The cost is invisible. The customer does not complain; they just go quiet. If your quote-to-job rate has slipped over the last eighteen months and you cannot say why, this is the first thing to check.
The five-minute check
You do not need an IT department for this.
- Send a quote, as you normally would, to a Gmail address you own, ideally a fresh one that has never received email from you.
- In Gmail, open the message, click the three dots and choose "Show original".
- Look at the three lines near the top: SPF, DKIM and DMARC. Each should say "PASS". If any says "FAIL" or "NONE", your quotes are at risk.
- Repeat with an Outlook.com address if you can.
- Then check your domain at a free online checker (search for "DMARC checker") to see which records exist.
If everything passes, well done, and move on to the next section. If not, keep reading.
How to fix it
The fix is three small records added to your domain's settings, usually at the company that registered your domain or hosts your website. Your email provider has the exact values; Google Workspace and Microsoft 365 both publish step-by-step pages, and most hosting companies will add the records for you if you ask.
- SPF: one record listing every service that sends email for you. Include your mail provider, your surveying or quoting software, your accounts package and your website's contact form.
- DKIM: switch on signing in your email provider and publish the key it gives you. For other sending services, switch on their DKIM too.
- DMARC: publish a policy. Start with "monitor only" (p=none) so nothing legitimate is blocked, read the reports for a few weeks, then tighten it.
Two common mistakes keep firms in the spam folder even after they think they have fixed it. The first is forgetting a sending service, so the surveying software's reports fail while office email passes. The second is a mismatch between the address on the From line and the domain that passed the checks, which is the alignment DMARC insists on. Test again after every change, using the five-minute check above.
Every website we build comes with the domain and email records set up correctly, so your quotes arrive and your business can be verified.
Authenticated email, a quote form that lands in your inbox, and the same verified business details on your website, in your Google profile and in the information AI tools read.
What this has to do with your website
Email trust and web trust are the same question asked by different machines: can this business be verified? The filters that decide whether your quote reaches the inbox are checking your domain. Google, ChatGPT and Gemini are checking the same domain when they decide whether to recommend you. A domain that is properly set up, consistently used, and backed by a website that states who you are, what you hold and where you work scores well on both.
That is why we treat email authentication as part of building a website rather than an afterthought. When we build a site for an asbestos contractor, the domain is set up with SPF, DKIM and DMARC from the start, the contact form sends authenticated mail that lands in your inbox, and the same verified business details appear on the website, in your Google Business Profile and in the information AI tools read. The result is a business that both filters and AI assistants can trust. Our guide to how AI search chooses asbestos companies shows how much of that decision rests on verifiable facts.
Why ignoring this would be a mistake
The direction of travel is clear. Google has said its sender requirements will keep tightening, Microsoft now rejects unauthenticated high-volume mail outright, and research from the email security firm Red Sift suggests only around 16% of domains worldwide have DMARC in place. The firms that fix it now gain an advantage in every corporate inbox. The ones that do not will keep losing quotes they never knew were lost, and as AI tools take a bigger share of how buyers find contractors, the same gaps in verifiable business information will cost them there too. Our AI visibility audit is the fastest way to see whether that is already happening to you.
Where to start
Do the five-minute check today. If your quotes are failing, fix the three records this week; it is the highest-return hour you will spend on marketing all year. Then run our free website check, which scores your site on the four stages buyers and AI tools follow, with a personal review from our team within one working day. If the website is part of the problem, our websites for asbestos contractors come with the domain and email records set up correctly, so your quotes arrive and your business can be verified wherever buyers look.
Sources: Google, Email sender guidelines; MailReach, Gmail sender guidelines 2026 guide; Red Sift, 2026 guide to Microsoft, Google and Yahoo sender requirements; Beancount, why business emails land in spam, September 2026.
Questions this raises
Why do my asbestos quotes go to spam?
Most often because your domain has no SPF, DKIM or DMARC records, or a sending service such as surveying software is missing from them. Corporate filters at councils, housing associations and main contractors treat unauthenticated email with a price and an attachment as a likely scam.
Do the 2026 email rules apply to small businesses?
The strictest rules apply to senders of more than 5,000 messages a day, but the same checks run on every message. Google requires at least SPF or DKIM from every sender, and a domain with no records is treated with suspicion whatever its volume.
Will fixing SPF, DKIM and DMARC stop all my emails going to spam?
It removes the most common cause, but not every one. Content, attachments, sending reputation and whether the recipient has dealt with you before also matter. Repeat the five-minute check after any change.
Can my website company set this up?
Yes, if they manage your domain or hosting. We set up all three records as part of every website build and check that the contact form sends authenticated email.
Make sure your quotes arrive and your business can be verified.
Run the free check and see how your website scores on the four stages buyers and AI tools follow, with a personal review from our team within one working day.
