Why are my emails going to spam? The fixes that work

By Akash Sengar · 6 October 2026 · 8 min read

Start here: a five-minute check

When genuine mail starts landing in spam or junk, resist the urge to rewrite the email first. In most cases the cause is technical and visible in public DNS. Run your domain through our free email security check. It reads your MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records in your browser and counts SPF DNS lookups.

Then send a test message to a personal Gmail and an Outlook.com address and open the original headers ("Show original" in Gmail, "View message source" in Outlook). Look for spf=pass, dkim=pass and dmarc=pass. Any fail or none is your first lead.

SPF, DKIM, DMARC and alignment

Mailbox providers use three DNS-based checks to decide whether a message really comes from your domain:

• SPF (RFC 7208) lists the servers allowed to send for your domain. It fails when you add a new sending service (a CRM, helpdesk or newsletter tool) and forget to add it, or when the record goes over the 10 DNS lookup limit. See SPF too many DNS lookups.
• DKIM signs each message with a key published in your DNS. Most platforms (Microsoft 365, Google Workspace, Zoho Mail) need DKIM switched on per domain; it is often left off after setup.
• DMARC (RFC 9989, which replaced RFC 7489 in 2026) tells receivers what to do when SPF and DKIM do not line up with the visible From address, and sends you reports.

The detail that catches most people is alignment. DMARC passes only if SPF or DKIM passes for the same domain that appears in the From address. A marketing tool can pass SPF for its own domain and DKIM with its own key, and the message still fails DMARC for yours. The fix is to set up a custom sending domain or DKIM key in that tool.

Gmail, Yahoo and Outlook sender rules

Since February 2024, Google and Yahoo require every sender to have SPF or DKIM, valid forward and reverse DNS for sending IPs, TLS, and a low spam rate. Senders of bulk mail (Google uses roughly 5,000 or more messages a day to personal Gmail accounts) must also have SPF and DKIM, a DMARC record (at least p=none), alignment, and one-click unsubscribe for marketing mail.

Microsoft announced matching requirements for domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses, enforced from 5 May 2025: SPF, DKIM and DMARC at least p=none aligned with SPF or DKIM, plus a working unsubscribe and valid From and Reply-To addresses. Non-compliant mail can be sent to Junk or rejected. Our sender requirements guide compares the three side by side.

Spam complaints and one-click unsubscribe

Google's guidelines ask senders to keep the user-reported spam rate in Postmaster Tools below 0.10% and never let it reach 0.30% or higher. Every "Report spam" click counts against you, and people click it when unsubscribing looks hard.

Marketing and subscribed messages need a one-click unsubscribe using the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058, plus a visible link in the body. Google expects unsubscribes to be honoured within 48 hours. Most newsletter platforms add the headers for you; check that yours does for your domain.

Shared IPs, new domains and volume

If you send through a low-cost bulk service, you share its IP addresses with other customers, and their behaviour affects your reputation. Reputable platforms police this; cheap ones may not.

A brand-new domain or one that has never sent much has no reputation yet. Start with small volumes to engaged recipients and increase gradually over weeks. A sudden jump from a few hundred to tens of thousands of messages looks like a compromised account.

Keep marketing mail separate from transactional mail (invoices, password resets) where possible, for example on a subdomain such as news.example.com, so a campaign problem does not hold up invoices.

Content and link issues

Content matters less than it used to, but some patterns still hurt: link shorteners, links to domains with poor reputation, a single large image with no text, attachments such as macro-enabled Office files, and mismatched display text and link targets. Make sure every link in your template goes to a domain you control or a well-known service, and that the plain-text part says the same as the HTML.

Blocklists

If one provider rejects you with a bounce message naming a blocklist, look up your sending IP and domain on that list's own site and follow its removal process. Fix the cause first (an infected PC, an open form being abused, a purchased list); removal without a fix rarely lasts.

Someone is sending emails from my domain

If people receive messages that appear to come from you but you did not send them, your domain is being spoofed. Without DMARC enforcement, receivers have no instruction to block them, and the complaints can hurt your real mail.

1. Check your sent items and mailbox rules first, to rule out a compromised account. If an account is compromised, reset the password, revoke sessions and enable MFA.
2. Publish DMARC at p=none with a reporting address and read the reports to see every source sending as your domain.
3. Authorise and align your legitimate senders, then move to p=quarantine and p=reject. Our DMARC rollout guide explains the safe order.
4. For domains that never send email, publish v=spf1 -all and a DMARC record at p=reject.

Invoices and system mail

Accounting, ERP, CRM and helpdesk systems often send invoices, statements and ticket updates "as" your domain from their own servers. These are the messages customers most need, and the ones most often forgotten when SPF and DKIM are set up. Each system needs either DKIM signing for your domain or a custom sending domain that aligns with it.

If a system cannot authenticate properly, send from a subdomain dedicated to it, or route its mail through your Microsoft 365, Google Workspace or Zoho Mail tenant using an authenticated SMTP relay. Avoid a no-reply address that bounces: replies to invoices are often the first sign a customer did not receive something, and Microsoft's rules expect a valid From and Reply-To.

A step-by-step diagnosis

1. Run the email security check and fix any missing or failing record.
2. Check the headers of a test message to Gmail and Outlook.com for SPF, DKIM and DMARC pass, and for alignment.
3. List every service that sends as your domain and confirm each has DKIM set up for your domain.
4. If you send bulk mail, check Google Postmaster Tools and Microsoft's Smart Network Data Services for spam rate and reputation.
5. Confirm one-click unsubscribe works and is honoured quickly.
6. Review volume changes, list sources and content patterns from the weeks when problems began.
7. If a specific provider rejects mail, read the bounce code; it usually names the exact reason.