Why Your Emails Go to Spam (and How to Fix It for Good)

A customer says your invoice never arrived. A prospect finds your proposal three days late, in their junk folder. When legitimate mail goes to spam, the cause is almost never one "spammy word." It is usually one of four things: the receiving server can't prove the mail is really from you, your domain or IP has a weak reputation, the message looks like bulk mail people didn't ask for, or you keep mailing addresses that bounce or never engage. This guide walks through how to diagnose which one is hurting you and what to change.

AI Automation for Dental Practices: A Calmer Front Desk, Explained · 2:57 Subscribe

How mailbox providers decide: inbox, spam or reject

Gmail, Yahoo and Outlook.com don't publish their filtering algorithms, but their sender guidelines tell you what they check. Roughly in order:

1. Connection checks. Does the sending IP have valid forward and reverse DNS (a PTR record that matches)? Is the connection using TLS?
2. Authentication. Does the message pass SPF and/or DKIM, and does the domain in the visible From: address line up with them (DMARC)?
3. Reputation. How have recipients treated mail from this domain and IP in the past? Spam complaints, bounces to unknown users and spam-trap hits all count against you.
4. Content and engagement. Does the message look like mail recipients asked for, and do they open, reply to and keep it, or delete and report it?

If step 1 or 2 fails, nothing you do in step 4 will save the message. That's why authentication is the first thing to fix.

Cause 1: missing or broken authentication

Since February 2024, Gmail requires every sender to authenticate with SPF or DKIM, and anyone sending close to 5,000 or more messages a day to Gmail accounts must have SPF, DKIM and DMARC. Yahoo has matching rules, and since May 5, 2025 Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day. In November 2025 Google said it was ramping up enforcement, with non-compliant mail facing temporary and permanent rejections. Our breakdown of the Gmail, Yahoo and Microsoft sender requirements covers the details.

The three records work together:

The most common authentication failures

• No SPF record, or two of them. A domain must have exactly one SPF record. Two v=spf1 records cause a permanent error, which counts as a failure. See what an SPF record is for correct syntax.
• SPF over the 10-lookup limit. Every include: adds DNS lookups. Go past 10 and SPF returns PermError.
• A third-party tool that isn't authorized. Your newsletter platform, CRM, help desk or invoicing app sends "as you" but was never added to SPF or set up to sign with DKIM for your domain.
• DKIM not turned on. Many providers, including Microsoft 365 and Google Workspace, need you to publish a key and enable signing for your custom domain.
• No alignment. The message passes SPF for bounces.vendor.com and DKIM for vendor.com, but your From: address is you@yourbusiness.com. DMARC fails because neither passing domain matches yours.

How to check a real message

Open a message you sent to a Gmail account, choose Show original, and look at the summary at the top:

SPF:   PASS with IP 203.0.113.25
DKIM:  'PASS' with domain yourbusiness.com
DMARC: 'PASS'

If DKIM shows a vendor's domain instead of yours, or DMARC says FAIL, you have found your problem. In Outlook, the same information is in the Authentication-Results header.

You can also run a free audit on your domain. The Email section checks your SPF, DKIM, DMARC, MTA-STS and BIMI records and flags syntax problems and missing records in the fix list.

Cause 2: weak sender reputation

Reputation is attached to your sending IP and, more and more, to your domain. You can't buy it. You earn it from how recipients react.

What damages it:

• Spam complaints. Gmail and Yahoo both require bulk senders to keep their user-reported spam rate below 0.3%, and Google recommends staying below 0.1%. That is 1 complaint per 1,000 delivered messages.
• Bounces to addresses that don't exist. A high rate of "user unknown" bounces tells receivers you're using an old or purchased list.
• Sudden volume spikes. Going from 200 emails a week to 20,000 overnight looks like a compromised account. Google advises increasing volume gradually.
• Shared IP neighbors. On a cheap shared sending pool, other customers' behavior can affect you.

Where to see your reputation

• Google Postmaster Tools shows your spam rate, authentication results and compliance status for mail to Gmail users. Verify your domain with a TXT record to get access. Data appears only once you send meaningful volume to Gmail.
• Microsoft SNDS shows data for IPs sending to Outlook.com, and the Junk Mail Reporting Program (JMRP) forwards complaints to you.
• Bounce messages. Read them. A 550 5.7.515 from Outlook.com or a 5.7.26-style rejection from Gmail names the authentication requirement you failed.

Cause 3: content that looks unwanted

Content filtering matters less than most people think, but it still plays a part, especially for new domains with no history.

Practical rules:

• Send from your own domain. Don't send business mail from a free webmail address through a marketing platform. It can't align with DMARC, and Gmail's guidelines specifically say not to impersonate Gmail From: headers.
• Make links match your brand. Link shorteners and tracking domains that have been used by spammers can get you filtered. Many platforms let you set up a branded tracking domain.
• Balance images and text. A single large image with almost no text is a classic spam pattern.
• Keep HTML clean. Broken markup pasted from word processors, hidden text and huge attachments all add risk.
• Use a recognizable From: name and a real reply-to address. People report mail as spam when they don't recognize who sent it.
• Follow message formatting rules. Gmail requires messages to follow RFC 5322. Missing Date or Message-ID headers usually means a misconfigured script or plugin.

Cause 4: poor list hygiene and missing unsubscribe

Even perfectly authenticated mail goes to spam if recipients don't want it.

• Only mail people who opted in. Purchased and scraped lists bring spam traps, bounces and complaints.
• Remove hard bounces right away. Microsoft's postmaster policies say not to keep sending after a permanent 5xx error. Checking new sign-ups with our free email verifier catches mistyped and fake domains before they bounce.
• Retire inactive subscribers. If someone hasn't opened or clicked in many months, send a re-engagement message, then stop mailing them if they don't respond.
• Make unsubscribing easy. Gmail and Yahoo require bulk senders to support one-click unsubscribe for marketing mail with these headers, and to show a visible unsubscribe link in the body:

List-Unsubscribe: <https://example.com/unsubscribe?u=8f2c1a>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Yahoo requires unsubscribes to be honored within 2 days, and Google recommends processing them within 48 hours. If unsubscribing is hard, people press "Report spam" instead, and that does far more damage.

A diagnosis order that works

When mail starts landing in spam, go through these steps in order:

1. Check one real message's headers. Do SPF, DKIM and DMARC all pass, aligned with your From: domain?
2. Check DNS. One SPF record, under 10 lookups, DKIM published for every service that sends as you, and a DMARC record with a reporting address.
3. Read your DMARC reports. They show every IP sending as your domain and whether it passes. See how to read DMARC reports.
4. Check reputation dashboards. Postmaster Tools and SNDS.
5. Review recent changes. A new ESP, a new website contact form, a DNS migration that dropped TXT records, or a big send to an old list.
6. Fix the list. Remove bounces and long-term non-engagers, and confirm unsubscribe works.

Frequently asked questions

Why do my emails go to spam in Gmail but not Outlook?

Each provider uses its own filters and reputation data. Gmail weighs user feedback from its own users heavily, so a list with many unengaged Gmail addresses can hurt you there and nowhere else. Check Google Postmaster Tools for your Gmail-specific spam rate and authentication results.

Will removing words like "free" keep my email out of spam?

Rarely. Modern filters rely far more on authentication, reputation and recipient behavior than on keywords. Fix SPF, DKIM, DMARC and list quality first, then look at content.

How long does it take to recover a damaged sender reputation?

There is no published timeline. Reputation improves as receivers see consistent, authenticated, wanted mail with low complaints. Expect it to take weeks of good sending, not days, and avoid volume spikes while you recover.

Do I need DMARC if I only send a few emails a day?

Strictly, Gmail and Yahoo only require DMARC from bulk senders. But a DMARC record with p=none takes five minutes to publish, gives you reports on who is sending as your domain, and is the first step toward blocking spoofing. Every business domain should have one.

Should I use a dedicated IP?

Only if you send enough steady volume to build its reputation. Low-volume senders usually do better on a well-managed shared pool, because a dedicated IP with little traffic has no reputation to fall back on.

What to do next

Start with authentication, because it is the part you fully control and the part receivers now enforce. Send a test to a Gmail address, read the headers, then fix whatever doesn't pass. Our email authentication checklist puts every record on one page, and a free audit will show you which of them your domain is missing.

Related reading

• DMARC Fail: What It Means and How to Fix It Quickly: DMARC fail means neither SPF nor DKIM passed for a domain matching your From address. Learn how to read the headers, find the cause and fix it safely.

Sources

• Google: Email sender guidelines
• Google: Email sender guidelines FAQ
• Yahoo Sender Hub: Sender best practices
• Microsoft: Outlook.com postmaster policies, practices and guidelines
• RFC 7208: Sender Policy Framework (SPF)