# Why are my emails going to spam? A diagnosis in six steps

> Why your emails go to spam, and how to find out which reason applies to you: authentication, a tool sending as your domain, reputation, server basics or content. Check them in this order and fix the first one that fails.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/why-are-my-emails-going-to-spam

Your emails go to spam for one of five reasons, and they are worth checking in this order: your domain fails authentication (SPF, DKIM or DMARC), a tool sends mail as you without being set up, your sending reputation is poor from complaints or old lists, your mail server lacks basics such as reverse DNS, or the message itself looks like spam. Most cases stop at the first two, and both are fixed in your DNS and your tools' settings in under an hour.

This guide is for small businesses, shop owners and marketers whose invoices, replies or newsletters are landing in junk. You will know which of the five applies to you and what to change. Authentication is the foundation; the [SPF, DKIM and DMARC setup guide](https://getreport.app/guides/spf-dkim-dmarc-email-authentication) explains the three records if they are new to you.

## Quick answer

- **Check your domain's records first** with the free [email and DNS health check](https://getreport.app/tools/email-dns-check): one SPF record under 10 lookups, DKIM for every sender, and a DMARC record.
- **Open a message that landed in spam** and read its headers (Gmail: **Show original**). `SPF: PASS`, `DKIM: PASS` and `DMARC: PASS` rule out authentication.
- **List every tool that sends as your domain:** mailbox, newsletter, shop, CRM, helpdesk, website forms. Each one needs DKIM for your domain.
- **Watch complaints:** Google asks senders to stay below a 0.1% spam rate and never reach 0.3%. Stop mailing people who never opted in or have not opened in a year.
- **Content comes last.** Link shorteners, image-only messages and misleading subjects hurt, but rarely outweigh broken authentication or a bad list.

## Step 1: find out where it happens

Before changing anything, narrow the problem down. Send the same message from the same tool to a Gmail address, an Outlook.com address and, if you can, a Yahoo address, and note where it lands.

- **Spam everywhere:** almost always authentication or a sending tool that is not set up. Go to step 2.
- **Spam at one provider only:** usually reputation with that provider, or a stricter rule it applies. Step 4 matters most.
- **Only one kind of message:** the newsletter lands in spam but personal replies do not. The newsletter tool is the one to fix, in step 3.
- **Only one recipient:** their own filters, a rule, or they once marked you as spam. Ask them to move a message to the inbox and add you to their contacts.

A message in Gmail's **Promotions** tab is not in spam. Gmail sorts marketing mail there by design, and no DNS record changes that.

## Step 2: check your authentication

Receivers trust mail that proves it comes from your domain and distrust mail that cannot. Three DNS records do the proving:

- **SPF** lists the servers allowed to send for your domain. One TXT record, starting `v=spf1`.
- **DKIM** signs each message with a key published in your DNS, so receivers can check it is yours and unchanged.
- **DMARC** checks that the From address people see passed SPF or DKIM, and tells receivers what to do when it did not.

> **Free tool:** [DMARC, SPF, DKIM and MX record checker](https://getreport.app/tools/email-dns-check): Free DMARC checker that also tests SPF, DKIM and MX. See what is missing or broken and get the exact DNS records to add. No sign-up, results in seconds.

The check reads all three in about 5 seconds, follows every SPF include to count lookups, tries 27 common DKIM selectors and writes the record to paste for anything missing, for your provider when your MX records reveal it.

> **Check: SPF syntax and lookup limit.** A broken SPF record counts as no record at all. The most common break is more than 10 DNS lookups once every include is followed, which makes receivers give up with a "permerror".
>
> 1. Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.
> 2. Replace mx, a and ptr mechanisms with the ip4 or ip6 ranges they stand for when you are close to the limit.

> **Check: The domain publishes a DMARC record.** Since February 2024, Gmail and Yahoo require DMARC from anyone who sends them more than 5,000 messages a day. DMARC also tells receivers what to do with mail that pretends to come from your exact domain.
>
> 1. Add a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:reports@yourdomain to start collecting reports.
> 2. After a few weeks of clean reports, move to p=quarantine and then p=reject.
> 3. If there are two or more DMARC records, merge them into one: receivers ignore all of them.

Then confirm it on a real message. In Gmail, open a message you sent to yourself at a Gmail address, choose the three dots and **Show original**. The summary at the top shows SPF, DKIM and DMARC with PASS or FAIL. In Outlook, look for the `Authentication-Results` header in the message source.

The most common failures and where they are explained:

- **Two SPF records, or more than 10 DNS lookups.** SPF fails for every message. See [multiple SPF records and the 10-lookup limit](https://getreport.app/guides/multiple-spf-records-and-the-10-lookup-limit).
- **No DKIM, or DKIM for the provider's domain instead of yours.** See the guide to [what DKIM is and how to turn it on](https://getreport.app/guides/what-is-dkim).
- **No DMARC record.** Gmail, Yahoo and Outlook require one from anyone sending about 5,000 messages a day; the guide to [what DMARC is](https://getreport.app/guides/what-is-dmarc) has the first record to publish.
- **Bounces instead of spam.** When mail is refused outright, the bounce text tells you why; the guide to [the 554 5.7.5 DMARC error](https://getreport.app/guides/dmarc-fail-554-5-7-5) covers the usual ones.

If you use Google Workspace or Microsoft 365, the setup steps are in [SPF, DKIM and DMARC for Google Workspace](https://getreport.app/guides/spf-dkim-dmarc-google-workspace) and [SPF, DKIM and DMARC for Microsoft 365](https://getreport.app/guides/spf-dkim-dmarc-microsoft-365).

## Step 3: find the tools that send as you

Your mailbox provider usually passes all three checks. The mail that lands in spam typically comes from somewhere else that uses your address in the From line:

- a newsletter or marketing tool;
- your online shop's order and shipping emails;
- a CRM, helpdesk, booking or invoicing system;
- your website's contact forms.

Each of these needs to be set up for your domain, usually under a setting called "authenticate your domain", "sender authentication" or "branded sending domain". The tool gives you DNS records, usually CNAMEs for DKIM, and you publish them. Until then it signs with its own domain, and your mail fails DMARC.

WordPress is a frequent culprit. By default it sends form and order mail through the web server with PHP's mail function: no DKIM, from an IP address that is not in your SPF record, often from `wordpress@yourdomain`. An SMTP plugin such as WP Mail SMTP, FluentSMTP or Post SMTP sends it through your mailbox provider or a transactional email service instead, and the problem disappears.

Once your DMARC record has a report address, the daily reports list every server that sent as your domain, including the ones nobody remembered. Our guide to [reading DMARC aggregate reports](https://getreport.app/guides/dmarc-reports) shows how to use them for exactly this.

## Step 4: check your sending reputation

Mailbox providers learn from how their users react to your mail. If people mark it as spam, delete it unread or never open it, more of it goes to spam next time. Authentication tells them who you are; reputation tells them whether people want you.

What hurts reputation most:

- **Spam complaints.** Google's sender guidelines ask all senders to keep the rate reported in Postmaster Tools below 0.1% and never let it reach 0.3%. That is 1 complaint per 1,000 messages as a target.
- **Mailing people who did not ask.** Bought lists, old customer exports and scraped addresses produce complaints and spam traps.
- **Old, unengaged addresses.** Addresses that have not opened anything in a year are often abandoned or recycled. Remove them.
- **Sudden volume.** A new domain, or a domain that suddenly sends 20,000 messages after months of silence, looks like a spammer. Start with your most engaged recipients and grow over a few weeks.
- **A hard-to-find unsubscribe link.** People who cannot unsubscribe press "Report spam" instead. Bulk senders must offer one-click unsubscribe; see the [Gmail and Yahoo bulk-sender requirements](https://getreport.app/guides/gmail-yahoo-bulk-sender-requirements).

Where to see it: Google Postmaster Tools shows your domain's spam rate and authentication results at Gmail once you verify the domain and send enough mail; Microsoft's Smart Network Data Services (SNDS) shows data for IP addresses you control; Yahoo offers a complaint feedback loop. Newsletter tools show complaint and bounce rates per campaign.

If you use a newsletter tool on shared IP addresses, its other customers affect you a little too. Reputable tools police this; a dedicated IP only helps once you send a steady, large volume.

## Step 5: check the server basics

This step matters when you run your own mail server or send from a web server. With Google Workspace, Microsoft 365 or a newsletter tool, the provider handles it.

- **Reverse DNS (PTR).** The sending IP address should have a PTR record naming a host whose forward DNS points back to the same IP. Google requires this from all senders.
- **TLS.** Send over an encrypted connection. Google requires it for all senders.
- **Blocklists.** Look the sending IP address up on a public blocklist checker. Spamhaus, for example, lets you check an IP and request removal once the cause is fixed.
- **A working MX record.** Receivers trust domains that can receive replies more than send-only ones.

> **Check: Mail servers (MX).** Without an MX record, mail sent to your address bounces or is guessed from the website's address. Mailbox providers also trust domains that receive mail more than send-only ones.
>
> 1. Add the MX records your email provider lists (Google Workspace, Microsoft 365, Zoho and your host all publish them) in your DNS zone.
> 2. If the domain never receives email, publish a null MX ("0 .") so senders fail fast instead of retrying.

## Step 6: check the message itself

Content filters matter less than they once did, but they still tip borderline mail:

- **Links whose text shows one domain and whose address goes to another**, or public link shorteners, which spammers use heavily.
- **Image-only messages** with little or no text.
- **A From name or subject that misleads**, such as "Re:" on a first message or a fake invoice subject.
- **Attachments** people did not expect, especially archives and macro-enabled documents.
- **Broken HTML** from pasting a document into the editor.

A plain, honest message with a working unsubscribe link and a real reply address is the safest format.

## How to prevent emails from going to spam

Once you have fixed the cause, keep it fixed:

1. **One SPF record, maintained.** When you add or drop a sending tool, update it the same day.
2. **DKIM on in every tool** that sends as your domain, for your domain.
3. **DMARC with a report address**, moving from `p=none` to `quarantine` and `reject` once the reports show only your real services; the [DMARC policy guide](https://getreport.app/guides/dmarc-policy-none-quarantine-reject) has the steps.
4. **Separate marketing from transactional mail**, for example newsletters from `news.example.com`, so a bad campaign does not drag invoices into spam.
5. **Keep lists clean:** confirmed opt-in, a visible unsubscribe link, and removal of addresses that bounce or never engage.
6. **Re-check after DNS or provider changes.** Moving DNS hosts or email providers is the most common moment for records to disappear.

## Questions people ask

### Why do my emails go to spam in Gmail but not in Outlook?

Because each provider judges reputation separately. Gmail weighs how its own users react to your mail, so complaints or low engagement from Gmail users hurt you there only. Check Google Postmaster Tools for your spam rate and authentication results, make sure DKIM is signed for your domain, and stop sending to Gmail addresses that never open.

### Why does my Outlook email go to the junk folder?

Most often because authentication fails or reputation is low at Microsoft. Check that your domain has one valid SPF record, DKIM signing for your domain and a DMARC record. Microsoft also rejects high-volume mail to Outlook.com that lacks all three. If authentication passes, ask a recipient to mark a message as Not junk and add you to their safe senders.

### Will a brand-new domain land in spam?

It often does at first, because receivers have no history for it. Set up SPF, DKIM and DMARC before you send anything, start with small volumes to people who expect your mail, and grow over a few weeks. Sending thousands of messages on day one from a domain registered last week looks exactly like a spammer.

### Can one spam complaint hurt my email deliverability?

One complaint alone will not, but the rate matters. Google asks senders to stay below a 0.1% spam rate, one complaint per 1,000 messages, and treats 0.3% as a hard limit for bulk senders. Complaints add up fast on lists people did not sign up for, so confirmed opt-in and an easy unsubscribe link protect you more than any record.

### Do links and images make an email go to spam?

Only in combination with other signals. Link shorteners, links whose visible text names a different domain, and messages that are one large image are common spam patterns, so they add suspicion. A well-authenticated message from a sender with a good reputation can contain links and images and still reach the inbox. Fix authentication and list quality first.

### Why do emails from my website contact form go to spam?

Because the website usually sends them itself, through the web server, without DKIM and from an IP address that is not in your SPF record. On WordPress, install an SMTP plugin and send through your mailbox provider or a transactional email service. Use your own domain in the From address and put the visitor's address in Reply-To.