SPF cleanup and lookup budget
Dead includes removed, the 10-lookup limit respected, subdomain delegation for marketing and transactional mail, and no fragile flattening services.
Flagship service · since 2018
Email deliverability, fixed for good.
We diagnose why your mail lands in spam or bounces, fix SPF, DKIM and DMARC properly, recover your domain's reputation, and keep it fixed. For teams on Google Workspace, Microsoft 365, Shopify, Zoho and cold-email tools. Bilingual, independent, and Google-certified.
Fixed price agreed before work starts · 30-day check-in included
Why mail lands in spam
Three causes explain almost every case.
Inbox providers do not guess. They score every message on authentication, on the reputation of the domain and the IP behind it, and on whether the sender was actually authorized. When one of the three is weak, filtering starts; when two are weak, rejection starts.
- Authentication gaps. A missing or broken SPF include, a DKIM key that was never enabled, or a DMARC record that never made it past p=none. Gmail and Yahoo have required all three for bulk senders since 2024.
- Reputation damage. A compromised mailbox, a spoofing wave or a shared hosting IP drags the domain down. Gmail answers with 550 5.7.1 rejections and Microsoft with 550 5.7.x until the reputation recovers.
- Unauthorized senders. The invoicing tool, the CRM, the store platform and the newsletter service all send as your domain. If they are not aligned with SPF or DKIM, DMARC treats them like spoofers.
Free, no sign-up. Paste a domain and see exactly what is wrong in about 30 seconds.
What we fix
The whole chain, not just the DNS records.
Every engagement starts with a written diagnosis and ends with a verified result. We touch your DNS only after the inventory of legitimate senders is complete.
DKIM at 2048 bits, aligned
Domain-level keys enabled on Google Workspace or Microsoft 365, third-party selectors set up, rotation documented.
DMARC to p=reject
From monitoring to enforcement in staged steps: none, quarantine, reject. Every legitimate sender verified before the policy tightens.
Reputation and blocklist recovery
Gmail 550 5.7.1, Microsoft 550 5.7.x and Spamhaus listings: we find the source, request delisting, and rebuild sending reputation with a warm-up plan.
Third-party sender alignment
Mailchimp, HubSpot, Klaviyo, Shopify, Tiendanube, Zoho, invoicing and e-invoicing providers, printers and scanners, all authenticated under your domain.
Monitoring and DMARC report review
Aggregate reports read every week, new senders flagged, and a monthly note that says whether anything needs attention.
How the engagement runs
Diagnose, fix, verify, then keep watching.
Diagnose in 48 hours
A free 30-minute call plus a written diagnosis: what is failing, why, and what it costs you while it stays broken.
Fix with a written scope
A fixed price agreed before any change. We make the DNS changes with you or for you, with rollback notes for each one.
Verify with evidence
Headers, DMARC reports and test sends to Gmail, Outlook and Yahoo confirm the fix before we close the project.
30-day check-in
We review the reports a month later at no extra cost and tell you plainly if anything drifted.
Guanacos Tech is an independent consultancy. Our team holds Google certifications, and we are not Google and not endorsed by Google.
Who this is for
Small and mid-sized teams whose email must arrive.
- Google Workspace and Microsoft 365 companies whose mail suddenly lands in spam, bounces, or gets rejected by Gmail.
- Shopify, Tiendanube and Zoho stores whose order confirmations and invoices never reach the customer.
- Teams on shared hosting or cPanel fighting the reputation of an IP they share with strangers.
- Cold-email and outbound teams that need SPF, DKIM, DMARC and one-click unsubscribe done right before the next campaign.
Three ways to start
Pick the entry point that matches your situation.
Free 15-minute deliverability triage
Bring your report or just your domain. You leave with the three DNS changes to make this week and a fixed price if you want us to do them.
DMARC to p=reject in 30 days
We inventory every legitimate sender, fix SPF and DKIM alignment, ramp the policy from none to quarantine to reject without dropping a real message, and hand you the monitoring.
Domain reputation rescue
Compromised mailbox, spoofing wave, Gmail 550 5.7.1 rejections or a blocklist listing. Within 48 hours we find and close the source, request delisting and lock SPF, DKIM and DMARC. Google Workspace and Microsoft 365.
Pricing is fixed per project and agreed after the free call. No hourly surprises.
Frequently asked questions
Does SPF ~all versus -all matter for deliverability?
Less than most guides claim. Softfail (~all) is the recommended default and spoofing is stopped by DMARC alignment, not by the SPF qualifier. Strict -all can break legitimate forwarding, so we only use it when the sender inventory is complete and forwarding is understood.
Do you work with Microsoft 365 domains?
Yes. Deliverability problems are about DNS, authentication and reputation, not about the mailbox provider. We configure DKIM in the Defender portal, fix the SPF include and the lookup budget, and handle Microsoft 550 5.7.x rejections as well as Gmail ones.
How long does it take to reach DMARC p=reject?
Usually 30 days for a domain with a handful of senders, longer when many third-party tools send on your behalf. We never skip the monitoring stage, because that is where hidden senders show up.
Can you get us off a blocklist?
Yes, and delisting is only half the job. Spamhaus and the other lists relist a domain quickly if the root cause is still there, so we close the source first, then request removal, then rebuild reputation.
Do you need admin access to our systems?
For DNS we can work from your registrar with you on a call, or with delegated access that you revoke afterward. For Google Workspace or Microsoft 365 we need an admin role only for the DKIM step, and we document every change.
Are you affiliated with Google?
No. Guanacos Tech is an independent consultancy. Our team holds Google certifications such as Professional Google Workspace Administrator and Professional Cloud Architect, and we are not Google, not a reseller, and not endorsed by Google.
Moving to Google Workspace too?
Migrations from Microsoft 365, Exchange, IMAP or cPanel, with authentication done right from day one.
Stop guessing why your email disappears.
Run the free check, then bring the report to a 30-minute call. You will leave with a plain answer and a fixed price.