Latest / Modularity Podcast / Why Your Invoices Keep Ending Up in Spam

Transcript

Why Your Invoices Keep Ending Up in Spam · Modularity Podcast

• 0:00
  Why do so many clients swear they never got the invoice, when you can literally see
• 0:03
  it marked sent in your software?
• 0:06
  Because half the time, it never made it to their inbox in the first place.
• 0:10
  Picture this.
• 0:11
  You are a contractor or running an agency, and you send an eighty five hundred
• 0:15
  dollar progress bill out of QuickBooks Online, or Jobber, or FreshBooks.
• 0:20
  Two weeks go by.
• 0:21
  No check.
• 0:22
  You call the client, and they say, hey, I never saw it.
• 0:25
  You check their junk folder, and there it is.
• 0:28
  Or worse, the receiving server bounced it with an SMTP five point seven point twenty
• 0:33
  six error.
• 0:34
  Yeah, that error is brutal.
• 0:36
  It basically means the receiving server refused to even accept the message because
• 0:41
  authentication completely failed.
• 0:43
  And from the client side, they did not even get a spam folder notification.
• 0:47
  It just vanished into the ether.
• 0:49
  Right.
• 0:50
  And, and, and it is a massive silent cash flow killer.
• 0:54
  But why does that happen?
• 0:56
  Because on your screen, it just says sent with a nice little green checkmark.
• 1:00
  Well, think about what is actually happening under the hood.
• 1:04
  You tell QuickBooks or whatever platform to put your company email in the From line.
• 1:10
  Say, billing at yourdomain dot com.
• 1:13
  But the physical machine sending that message across the internet belongs to Intuit,
• 1:19
  or Amazon Web Services, or SendGrid.
• 1:22
  So to the receiving mail server, say Google or Yahoo, it looks like an unauthorized
• 1:27
  courier showing up in your company uniform, driving an unmarked van,
• 1:31
  with zero identification.
• 1:33
  That is a perfect way to put it.
• 1:35
  The receiver looks at the return address, looks at the server IP address,
• 1:39
  sees zero relationship between the two, and goes, nope, this is phishing or fraud.
• 1:44
  And the rules got a lot stricter recently.
• 1:46
  Both Google and Yahoo started aggressively cracking down.
• 1:50
  If your spam complaint rate creeps up, you are in immediate trouble.
• 1:54
  The published threshold is strictly below zero point three percent.
• 1:58
  Think about that math.
• 1:59
  That is just three complaints per one thousand messages delivered.
• 2:04
  If three people out of a thousand click report spam because they did not recognize
• 2:09
  the sender, Google can start throttling your entire domain.
• 2:13
  Across what, over one billion consumer inboxes?
• 2:17
  MxToolbox pointed out that you risk missing out on over one billion inboxes if your
• 2:22
  authentication is sloppy.
• 2:24
  Exactly.
• 2:25
  And so software companies tried to offer a lazy workaround.
• 2:29
  QuickBooks, for instance, often defaults to sending from something like quickbooks
• 2:34
  at notification dot intuit dot com instead of your domain.
• 2:39
  Right, which bypasses the DNS setup, sure.
• 2:42
  But then your customer gets an email from a generic robot address.
• 2:46
  Half the time they ignore it or delete it because it looks like automated junk.
• 2:51
  Or worse, you train your customers to wire money based on unbranded notifications,
• 2:56
  which is an open invitation for invoice spoofing scammers to step in.
• 3:00
  Completely.
• 3:01
  It erodes your brand trust and puts your cash flow at risk just to avoid fifteen
• 3:05
  minutes of settings.
• 3:06
  So let us break down the alphabet soup here, because whenever developers start
• 3:11
  throwing around SPF, DKIM, and DMARC, business owners just tune out.
• 3:17
  Can we explain what these actually do without the jargon?
• 3:20
  Yeah, it really is not that mystical.
• 3:22
  Think of SPF, which stands for Sender Policy Framework, as your domain's authorized
• 3:27
  guest list.
• 3:28
  It is a single text record on your domain name that says, here are the specific
• 3:32
  server IP addresses allowed to send mail using my name.
• 3:36
  Got it.
• 3:36
  So if the IP sending the invoice is on that guest list, the bouncer at the door lets
• 3:41
  it pass.
• 3:42
  What about DKIM?
• 3:44
  DKIM is DomainKeys Identified Mail.
• 3:47
  That is like an old school wax seal stamped with your signet ring.
• 3:52
  Your billing software signs the outgoing message with a private cryptographic key,
• 3:59
  and your domain publishes the public key in your DNS.
• 4:03
  When the receiving server gets the message, it checks the seal to verify that nobody
• 4:08
  tampered with the invoice or altered the payment details in transit.
• 4:13
  Guest list, wax seal.
• 4:14
  Then where does DMARC fit in?
• 4:16
  DMARC is the policy manual you hand to the receiving server.
• 4:20
  It stands for Domain based Message Authentication, Reporting,
• 4:25
  and Conformance.
• 4:26
  It basically tells Gmail or Outlook, hey, if an email claiming to be from me fails
• 4:31
  the guest list check or the wax seal check, here is what you should do with it.
• 4:36
  Like quarantine it to spam, reject it completely, or let it through anyway and send
• 4:41
  me a report.
• 4:42
  Precisely.
• 4:43
  But here is the silent trap that catches so many small businesses when they try to
• 4:48
  fix this themselves.
• 4:49
  They log into their DNS and start pasting include tags into their SPF record for
• 4:55
  every tool they use.
• 4:56
  Google Workspace, Mailchimp, QuickBooks, HubSpot, Zendesk...
• 5:01
  and suddenly, nothing delivers.
• 5:04
  Wait, why does adding more authorized senders break it?
• 5:07
  Because the SPF specification has a hard limit of ten DNS lookups.
• 5:12
  If a receiving server has to query more than ten domain lookups to evaluate your
• 5:17
  single SPF string, it fails permanently.
• 5:21
  Your legitimate everyday Outlook or Google Workspace emails fail authentication
• 5:27
  alongside your invoices.
• 5:29
  Wow, so you break your normal company email just trying to get billing out the door.
• 5:34
  We see that all the time.
• 5:36
  The clean way around that is usually DKIM and CNAME delegation.
• 5:40
  Most modern billing tools will give you two or three CNAME records to plug into your
• 5:45
  DNS registrar, whether you use Cloudflare, GoDaddy, or Namecheap.
• 5:50
  That delegates the cryptographic signing without bloating your SPF lookups.
• 5:55
  And for DMARC, you do not have to jump straight to strict rejection.
• 6:00
  You can start with a policy of p equals none, which just acts as an observation
• 6:06
  mode.
• 6:07
  It tells inboxes to let mail deliver while sending daily XML reports so you can see
• 6:13
  who is sending on your behalf.
• 6:15
  Right, p equals none gives you full visibility without risking any false positives
• 6:19
  while you dial in the settings.
• 6:21
  So if someone is listening to this right now, what is the immediate,
• 6:26
  low lift action they should take this week?
• 6:29
  Go to a free diagnostic site like MxToolbox or MailReach.
• 6:33
  Run an email health check on your domain, or send a test invoice from your billing
• 6:38
  platform to one of their test addresses.
• 6:40
  It will tell you within sixty seconds whether your SPF, DKIM,
• 6:45
  and DMARC are properly aligned.
• 6:47
  Do not let an eighty five hundred dollar bill sit unpaid in a spam folder because of
• 6:54
  a missing DNS record.
• 6:56
  And if you run a business and want help cleaning up your digital infrastructure,
• 7:00
  web development, or workflow automation, check us out at modularity dot u s.
• 7:06
  Talk to you next time.
• 7:07
  Catch you later.