Why 20% of Business Emails Never Arrive
You just sent an important proposal to a client. You got no bounce, no error, no notification. The email simply vanished โ accepted by the receiver's mail server, analyzed by their spam filters, and silently discarded.
This happens to approximately 20% of legitimate business email. Not spam โ legitimate, wanted email that never arrives. The cost? Lost deals, delayed projects, missed opportunities, and eroded trust. Let's look at the data.
The Numbers: Email Deliverability by Domain Type
We analyzed DNS records across thousands of domains using the mailcheck API. Here's what we found:
๐๏ธ Government Domains
34% have no DMARC policy or p=none. 12% have broken SPF records. Many EU institutions are vulnerable to spoofing.
๐ข Enterprise (Fortune 500)
18% have SPF DNS lookup count exceeding 10. 8% have expired or weak DKIM keys. Average score: 72/100.
๐ SaaS Startups
45% have no DMARC record at all. 22% have multiple SPF records (RFC violation). Average score: 58/100.
๐ช Small Business
67% have no DMARC, 38% have SPF set to ?all (passive). Average deliverability score: 42/100.
The Root Causes
1. SPF Misconfiguration (Affects ~35% of domains)
SPF (Sender Policy Framework) tells receivers which IP addresses are authorized to send email on behalf of your domain. The most common problems:
- Multiple SPF records โ RFC 7208 says you can only have ONE. Having two causes receivers to reject your email.
- DNS lookup overflow โ More than 10 includes/lookups causes a PermError. Google Workspace (2 lookups) + SendGrid (1) + Mailchimp (1) + Salesforce (1) + your own MX/A records = fast overflow.
- Using
~allwhen you mean-allโ Softfail (~all) doesn't prevent spoofing; it just marks email as "suspicious."
2. DKIM Weaknesses (Affects ~15% of domains)
DKIM proves email wasn't tampered with in transit. Problems include:
- 1024-bit keys โ Cryptographically weak. Microsoft and Yahoo penalize these.
- Missing selector records โ When providers rotate selectors and don't update your DNS, DKIM verification silently fails.
- No DKIM at all โ Still the majority of small businesses.
3. DMARC Missing or Weak (Affects ~60% of domains)
DMARC ties SPF and DKIM together with a policy. The grim reality:
Without p=reject, attackers can forge your domain with near-impunity. Gmail and Microsoft are increasingly treating p=none as equivalent to no DMARC at all.
The Business Impact
Let's quantify the damage. Say your organization sends 10,000 emails per month:
- At 80% deliverability โ 2,000 emails never arrive. That's 2,000 lost touchpoints per month.
- Financial cost โ At an average customer LTV of $500 and 2% conversion rate, that's $20,000/month in lost revenue.
- Support overhead โ "Did you get my email?" becomes the most-asked question in your support queue.
- Reputation damage โ Clients who don't receive your emails don't blame their IT โ they blame you.
What to Do About It
Step 1: Audit your domain โ Check your deliverability score right now:
curl https://korpo.pro/api/v1/check/yourdomain.com
Step 2: Fix the top issues โ Read our SPF/DKIM/DMARC fix guide for step-by-step instructions.
Step 3: Monitor continuously โ DNS records change. Providers rotate keys. Set up automated monitoring.