Your Email Landed in Spam: Here's What to Check First

Why are my emails going to spam?

Mailbox providers such as Gmail, Yahoo and Outlook score every incoming message. They ask three questions. Can this sender prove who they are? Has this server or domain behaved well in the past? Do recipients want this mail? If the answer to any of them looks weak, the message goes to spam, or to Junk in Outlook.

Most people start by rewriting the subject line. That rarely helps. The cause is usually lower down, in DNS or in reputation. Work through the checks below in this order, because each one depends on the one before it:

1. Read the headers of a message that went to spam

   The receiving server writes its SPF, DKIM and DMARC results into the message. That tells you which layer failed.

2. Fix any failed authentication records

   A missing or broken SPF, DKIM or DMARC record is the most common cause, and the easiest to fix.

3. Check the sending IP against blacklists

   A listed IP can send perfectly authenticated mail and still be filtered.

4. Review bulk sender rules and engagement

   Once the technical side is clean, complaint rates, unsubscribe handling and list quality decide where your mail lands.

How to see why an email went to spam

Ask someone whose copy landed in spam to forward you the full original message, or send a test to your own Gmail or Outlook address. Then open the raw source. Everything you need is in the header lines above the body.

Where to find the raw email headers in Gmail and Outlook

The line to look for is Authentication-Results, which the receiving server adds. A healthy one looks like this:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=selector1;
       spf=pass smtp.mailfrom=bounce@mail.example.com;
       dmarc=pass (p=QUARANTINE) header.from=example.com

Reading headers by hand gets tedious, especially the chain of Received lines. Paste the whole header block into the Email Header Analyzer. It pulls out From, Return-Path, Reply-To, Subject, Date and Message-ID, lists each Received hop from oldest to newest with its IP, hostname and timestamp, and reads the spf, dkim and dmarc verdicts from Authentication-Results. It also warns you when any verdict is not a pass, when the From and Return-Path domains differ, or when a message has passed through more than 10 Received hops.

What SPF, DKIM and DMARC results mean

How to fix an email authentication failure

An email authentication failure means the receiver could not confirm that your domain allowed the message to be sent. Each of the three standards fails in its own typical way.

Why SPF fails even though you have a record

SPF lists the servers allowed to send mail for your domain. It is a TXT record that starts with v=spf1:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The usual problems are a sending service you forgot to include, two separate SPF records on one domain (only one is allowed), or a record that needs more than 10 DNS lookups. The SPF Checker finds your v=spf1 record, lists its mechanisms and counts the lookups. It reports an error above 10 lookups and a warning above 8. It also flags the deprecated ptr mechanism and a record with no all mechanism at the end.

Why DKIM fails

DKIM adds a cryptographic signature that the receiver checks against a public key published at selector._domainkey.yourdomain. DKIM fails when that key is missing, was never switched on in your email provider's dashboard, or no longer matches the private key. It also fails when something along the way changed the message after it was signed, such as a mailing list footer or a security gateway rewriting links.

Pingie's DKIM Checker looks up the record for a selector you enter. If you leave the selector blank, it tries common ones such as default, google, selector1 and selector2. Copy the s= value from a DKIM-Signature header to check the exact selector your provider uses.

Why DMARC fails when SPF and DKIM pass

DMARC adds one more test: alignment. At least one passing check has to belong to the same domain as the visible From address. If your newsletter tool signs with its own domain and uses its own bounce address, SPF and DKIM both pass for the tool's domain, but DMARC fails for yours. The fix is to set up a custom DKIM domain, and ideally a custom return-path domain, in that tool.

DMARC is a TXT record at _dmarc.yourdomain. A sensible starting point that collects reports without blocking anything:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The rules are defined in RFC 7489. Once the reports show that all your legitimate mail passes, move the policy to quarantine and then to reject.

Is your sending IP on a spam blacklist?

If authentication passes and mail still lands in spam, check the reputation of the server that sent it. Take the IP from the first external Received hop in your headers and run it through the IP Blacklist Checker. It queries eight DNS blocklists: Spamhaus ZEN, SBL, XBL and PBL, Barracuda, SpamCop, SURBL and SpamRATS. It accepts IPv4 and IPv6 and tells you how many of them list the address.

Keep the result in proportion:

• Shared IPs. If you send through Google Workspace, Microsoft 365 or a large email service, you share IPs with other customers, and the provider handles delisting. Contact their support team.
• Spamhaus PBL. This list covers dynamic and residential ranges that should not send mail directly. A listing there usually means you are sending from a home or office connection when you should use an authenticated relay.
• Your own server. A listing on your own IP usually points to a compromised account, an open relay or a form that bots abuse. Fix the cause before you request removal, or the listing will come back.

What are the Gmail and Yahoo bulk sender requirements?

Since February 2024, Gmail and Yahoo have enforced stricter rules for bulk senders. Google defines a bulk sender as a domain that sends close to 5,000 or more messages a day to personal Gmail accounts. The main rules in Google's email sender guidelines and Yahoo's sender best practices are:

• SPF and DKIM both set up for your sending domain.
• A DMARC record with at least p=none, and a From domain that aligns with SPF or DKIM.
• Valid forward and reverse DNS for sending IPs, so the PTR hostname resolves back to the same IP. You can confirm the PTR record with the rDNS Check.
• TLS for the connection that delivers the mail.
• One-click unsubscribe in marketing and subscription mail, with requests honoured within two days.
• A spam complaint rate that stays below 0.3%. Google recommends staying under 0.1%.

One-click unsubscribe uses two headers. Your email service usually adds them when you turn the feature on:

List-Unsubscribe: <https://example.com/unsubscribe?id=abc123>, <mailto:unsubscribe@example.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

To see your complaint rate and domain reputation as Gmail sees them, register your domain in Google Postmaster Tools. It only shows data once you send enough daily volume to Gmail users.

Why do emails go to spam when authentication passes?

Passing authentication proves who you are. It does not prove anyone wants your mail. With DNS in order, these are the usual causes:

• Low engagement. People who never open, or who delete without reading, teach the filter that your mail is unwanted. Stop mailing contacts who have not opened anything in months.
• Spam complaints. Every click on Report spam counts against you. Hard-to-find unsubscribe links make this worse.
• Bought or old lists. Old addresses bounce, and some have been turned into spam traps.
• A new domain or IP. Sending a lot of mail from a fresh domain looks like a spam run. Start with small daily volumes and increase them over a few weeks.
• Links and content. Link shorteners, a link to a domain with a bad reputation, one large image with no text, or a missing plain text part can all push a message over the line.
• A sudden spike. A jump in volume from a sender that is normally quiet looks like a compromised account.

Why are emails going to the junk folder in Outlook?

Outlook.com and Microsoft 365 run their own filtering, so mail that reaches the inbox at Gmail can still land in Junk at Outlook. Microsoft has announced requirements for high-volume senders to Outlook.com that are similar to Google's: SPF, DKIM and DMARC.

Two things are specific to Outlook. First, users' Safe senders and Blocked senders lists override the filter, so one recipient's result can differ from another's. Second, in a business tenant, an administrator's rules or quarantine policy can junk mail no matter how good your reputation is. In that case, look for the X-Forefront-Antispam-Report header. Its SCL value is the spam confidence level, and a value of 5 or higher usually sends mail to Junk.

How to improve email deliverability after a fix

DNS changes take effect once cached records expire, but reputation recovers more slowly. To rebuild email deliverability:

• Send a test to a Gmail and an Outlook address after every DNS change, and confirm all three checks show pass in the headers.
• Keep sending at a steady volume and resume with your most engaged recipients first.
• Remove hard bounces straight away and honour unsubscribes quickly.
• Send transactional mail, such as receipts and password resets, from a separate subdomain, so a marketing campaign cannot damage its reputation.
• Read your DMARC aggregate reports to find senders you forgot about, such as a CRM or help desk tool sending as your domain.

Frequently asked questions