A plain-English explanation for recruitment agency owners, written by Security Everywhere
You message a client on LinkedIn. They say, “send it to me over email.” You do. And you never hear back.
Not because they weren’t interested. Not because your candidate wasn’t right. Because the email never arrived.
If that sounds familiar, you are not alone, and you are not imagining it. We speak to recruitment agency owners every week who’ve quietly lost tens of thousands of pounds in placements this way — and most of them have no idea it’s happening, because a missed email doesn’t send you a notification. It just… doesn’t land. No bounce-back, no error message, nothing. It vanishes into someone’s spam folder, or gets rejected before it even gets that far, and you’re left wondering why a client who seemed so keen suddenly went quiet.
One agency owner we spoke with recently put a number on it: over £100,000 in lost business in his first nine months of trading, including a contact at a private equity firm who owned 16 companies and could have kept him busy for years. He’d done real research — set up the right technical records himself, cleaned up his email signature, even split his outbound marketing onto a separate domain to protect his main one. And his emails were still not reaching people. He just didn’t know why.
Why this happens (without the jargon)
Every major email provider — Microsoft 365, Google Workspace, all of them — runs your outgoing email through an invisible trust check before deciding whether it lands in someone’s inbox, their spam folder, or nowhere at all. Think of it like ID checks at passport control: your email needs three pieces of “identification” that prove it’s really you sending it, and hasn’t been faked or tampered with along the way. If those pieces of ID are missing, incomplete, or not properly linked together, inbox providers get suspicious — and increasingly, in 2025 and 2026, “suspicious” means “silently discarded,” not “flagged for review.”
The technical name for this identification system is DMARC (working alongside two other records called SPF and DKIM). You don’t need to remember what the letters stand for. What you need to know is this: most recruitment agencies have never set this up properly, and most of the ones who’ve tried to do it themselves still have it wrong — not because they’re careless, but because it’s genuinely easy to get 80% of the way there and still fail the parts that actually matter, and there’s no dashboard that tells you “hey, this is broken.”
We ran a live check on that agency owner’s domain, and then — with his permission — checked two of his competitors’ domains the same way, on the same free tool, while he watched. His own domain scored 2 out of 5. One competitor scored 0 out of 5. The other scored 3 out of 5. Not one of the three had it fully right. That’s not unusual: having tested hundreds of company domains ourselves, only around 2 in every 100 score a full 5 out of 5. The rest are losing an unknown amount of business to it, every single day, without any way of knowing.
Why this matters more for recruitment than almost any other industry
Most businesses can survive a few missed emails. Recruitment can’t. Your entire model depends on a candidate’s CV reaching a hiring manager’s inbox at the right moment, and on a client trusting that when you say “I’ve sent it over,” it actually arrives. If it doesn’t land, you don’t just lose that one email — you lose the placement, the fee, and often the relationship, because from the client’s side, it just looks like you went quiet.
And it compounds. One recruiter we know built over half of a previous business purely from email outreach — 50-plus new clients in a year. At their next venture, with the same effort and the same quality of outreach, they converted zero clients from email. Same skill. Same message. Different, broken, technical foundation underneath it.
What to do about it
You don’t need to become a technical expert to fix this — you need someone who deals with it every day to check it, fix it, and keep it that way, because these settings can quietly break again as you add new tools, change providers, or grow.
The first step costs nothing and takes about 30 seconds: run a free check on your own domain to see where you actually stand. If you’re already confident, check a competitor’s too (with a client hat on, not a hacker’s) — you might be surprised.
If it comes back anything less than a perfect score, that’s not a reason to panic. It’s a reason to get it looked at properly by people who specialise in exactly this — because the fix, done right, takes weeks, not months, and the alternative is carrying on losing placements you’ll never even know you lost.
Security Everywhere has worked in the recruitment sector for close to three decades. If you’d like your domain checked properly, or just want a straight answer on what’s going on with your email, get in touch — no obligation, no jargon.
More for recruitment firms: deliverability is one piece of a bigger picture. See our cyber security for recruitment agencies page for the rest.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
