Why are my emails going to spam? How to fix it

Start here: what are you seeing?#

Your order confirmations reach most customers, but one client on Microsoft 365 finds them in Junk. Your newsletter’s clicks from Outlook addresses halve while Gmail holds steady. Those are different problems with different fixes. Find what you see below; if a bounce message gave you a code, go to what a bounce code means.

For most small businesses the fix is the same three steps: read the dmarc line in one copy that landed in spam, set up your domain in every service that sends as you, and publish a DMARC record. Using a sending service? Check two things in its dashboard first: that your domain shows as verified, and what the log says happened to one affected message.

How to read the headers in Gmail and Outlook#

Headers are hidden lines above every email that record where it came from. The one that matters is Authentication-Results, which the receiving server adds to say whether your domain’s three checks (SPF, DKIM and DMARC, explained below) passed. Open a copy that landed in spam, ideally in your own test account.

In Gmail on a computer#

1. Open the email.
2. Next to Reply, click More (the three dots, ⋮).
3. Choose Show original. The full header opens in a new window, with a Copy to clipboard button.^[2]

In Outlook#

In Outlook.com, Outlook on the web and the new Outlook, open the message, select More actions at the top, then View → View message details. In classic Outlook for Windows, double-click the message, then File → Properties; the header is in the Internet headers box.^[4]

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com;
       spf=pass smtp.mailfrom=mail.example.com;
       dmarc=pass (p=NONE) header.from=example.com

• header.from is the domain your reader sees in the From line. smtp.mailfrom is the hidden return address bounces go to, often on a subdomain of your sending service’s choosing, so there are two domains.^[5]
• dmarc=pass means SPF or DKIM passed for a domain that matches the From domain. One is enough.^[6]

Read the DMARC result first:

• dmarc=none: no DMARC record was found for the From domain.^[5] Publish one (see authentication).
• dmarc=fail: neither SPF nor DKIM passed for a domain matching the From domain. Fix the sending service’s setup for your domain (see mail other services send).
• dmarc=pass: your domain’s records are not the problem, though its reputation still can be. (On a forwarded copy, an SPF softfail beside it is normal: DKIM carried the pass.) The cause is reputation, content or the recipient’s own filter: go to complaints and list quality or, for a business recipient, Microsoft 365.

Test where your email lands, for free#

Your sending tool shows that a message was delivered (accepted by the receiving server), not which folder it reached. A seed test shows the folder: send your real message, through your normal path, to free accounts you create at Gmail, Outlook.com and Yahoo, plus a work address on Microsoft 365 or Google Workspace if your customers use those. Keep each copy’s headers.

It compares providers rather than forecasting: a test account has never clicked or replied to your mail, so your customers can see a different folder.

For a newsletter, a cheaper signal: split clicks by recipient domain (gmail.com, outlook.com, yahoo.com) and look for the one that falls alone.

What a bounce code means#

A bounce is the message a receiving server sends back when it refuses or delays your email. A code starting 4 is temporary, so your sending server tries again; one starting 5 is permanent.^[7] The words after the code say why.

Fix your domain’s records: SPF, DKIM and DMARC#

These fixes happen in DNS (the Domain Name System), the internet’s public directory for domain names. Your domain’s records live at your DNS host, which Google describes as “typically where you purchased your domain name”.^[9] Look there for a page called DNS settings or DNS records, not in Gmail or Outlook. Each service that sends for you gives you the records to paste in.

Don’t know who manages your DNS? Search your inbox for the domain’s renewal receipt: it names the registrar, the company you bought the domain from. That is usually the DNS host, unless someone moved the domain’s name servers elsewhere, such as to a website builder. To be sure, enter your domain on Google’s free Dig (DNS lookup) page and choose NS: the server names in the answer belong to your DNS host.^[12] If you don’t recognise them, ask whoever built your website.

• SPF lists the servers allowed to send for your domain.
• DKIM is a signature your sending service adds, checked against a public key in your DNS.
• DMARC asks that SPF or DKIM pass for the same domain as the From address, a match called alignment.

A record has a type, a name (or host) and a value. For a domain that sends only through Google Workspace, Google’s SPF value is v=spf1 include:_spf.google.com ~all, added as type TXT on the domain itself (often written @).^[11] If several services send for you, they share that one record: two records starting v=spf1 make SPF return an error (permerror), so it does not pass, and so does a merged record that needs more than 10 DNS lookups. A merged record looks like v=spf1 include:_spf.google.com include:spf.example-service.com ~all, and each include: costs at least one lookup.^[14]

Even at a few hundred emails a month, Gmail asks every sender for SPF or DKIM, along with basics such as reverse DNS and TLS; a bulk sender needs both SPF and DKIM, plus DMARC, alignment and one-click unsubscribe.^[10] You become one once you send about 5,000 messages to personal Gmail accounts in a day.^[8] Add a DMARC record either way: type TXT, name _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. p=none states no preference for mail that fails, so DMARC itself blocks nothing and does not yet stop anyone faking your domain. Reports arrive at the rua address as XML files, so use a mailbox that exists.^[6] The header then shows pass or fail instead of none, and tightening the policy later is in the DMARC rollout guide. To see what you publish, choose TXT on the Dig page, then try _dmarc. in front of your domain.

Mail other services send for you#

• Google Workspace. In the Admin console, go to Menu → Apps → Google Workspace → Gmail → Authenticate email, click Generate new record, add the TXT record at your DNS host, then return and click Start authentication.^[9]
• Microsoft 365. In the Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM, add the two CNAME records it shows, then switch on Sign messages for this domain with DKIM signatures.^[13]
• Shopify. In the Shopify admin, go to Settings → Notifications and, under Sender email, authenticate your domain. Its CNAME records cover DKIM and SPF; until they are in place, Shopify rewrites your sender to a Shopify address. Add the DMARC record yourself.^[21]
• WooCommerce. Set an address on your domain under WooCommerce → Settings → Emails, in the email sender options.^[22] By default it hands mail to WordPress, which sends through your web host’s mail function; WooCommerce recommends a dedicated SMTP provider instead.^[23] Set that provider up for your domain as above.
• Your email marketing app. Promotions come from it, and so do abandoned-cart emails unless your store platform sends them itself. Find its sending-domain or domain authentication setting and add its records; if it asks for SPF, add it to your one SPF record.
• Accounting or booking software. Search its help centre for “domain authentication” or “sender domain”; it gives you records to add. If it can only send under its own domain, inboxes cannot confirm the email came from you: ask its support for “sending from my own domain”, or use a From address on its domain instead.
• Your website’s contact form. Look at the From address on a notification. If it is the website builder’s own address, your DNS is not involved; mark it Not spam. If it is your domain, the builder sends as you and needs records like any other service.

Not sure which services send as your domain? DMARC reports list them; the DMARC rollout guide shows how to read them. If the problem mail goes out from your own Workspace or Microsoft 365 mailbox, a sending service such as Rasket is not the fix: that mail never passes through it.

Complaints, list quality and unsubscribes#

Once DMARC passes, recipients decide. Gmail tells its users that as they report more spam, it “identifies similar emails as spam more efficiently”.^[3] Google asks you to keep the spam rate in Postmaster Tools below 0.1% and never reach 0.3%.^[10] How that rate is counted is in spam complaint rate. Complaints and spam-trap hits come from five places:

• Addresses that never asked. Google’s guidelines say not to buy lists.^[10]
• Old addresses. Some dead addresses are turned back on as spam traps, which Spamhaus treats as proof of poor list collection or hygiene.^[15] Stop mailing hard bounces at once.
• Typos and fake sign-ups. Confirmed opt-in, where people click a link before they are added, keeps both off the list; M3AAWG, the industry anti-abuse group, calls it the “highest standard”.^[16] See double opt-in.
• Surprise. Tell subscribers at sign-up what you will send and how often, as Yahoo asks.^[19] A choice of topics or frequency makes people less likely to report you.^[16]
• Leaving is harder than complaining. Gmail sends mail that keeps arriving after someone unsubscribed “directly to Spam”.^[3] Make leaving one click with one-click unsubscribe, and stop mailing people who no longer read, as the sunset policy guide sets out.

A sending service’s suppression list does the stopping for you: it skips addresses that hard-bounced or complained. How a suppression list works.

Volume spikes, new domains and mixed mail#

A new domain has no reputation, and a sudden jump looks like a hijacked account. Start new or changed traffic at low volume to the people most likely to want it, raise it in small steps, and slow down whenever mail is delayed or bounces. The schedule is in the warm-up guide.

Reputation also spreads between kinds of mail. Google asks for one From address per category and says “don’t include promotions in sales receipt messages”, so a coupon block belongs in a marketing email, not the order confirmation.^[10] Yahoo: “Don’t send bulk/marketing email from the same IPs you use to send user mail, transactional mail, alerts, etc.”^[19] At minimum, send orders and promotions from different addresses, such as orders@ and news@. A subdomain such as news.example.com gives campaigns their own records and their own figures in Gmail’s dashboards; our line for it is about 1,000 campaign emails a month, and it is not a firewall, because Gmail still counts both toward bulk-sender status.^[8] The subdomain guide explains the line.

Check the blocklists, and how delisting works#

A blocklist is a public list of IP addresses or domains that receivers check before they accept mail. Spamhaus’s Domain Blocklist (DBL) is checked against the sender’s domain and also against “domains appearing in the mail headers and body e.g., URLs”, so a listed link domain can block a message from a clean sender.^[20] Check three things: the sending IP (in the bounce, or the Received headers), your From domain, and every domain your links point to. How to look each one up and ask for removal is in how to check a blocklist and get delisted.

If you send through a provider’s shared IPs, send the bounce to the provider; the IP is theirs to delist. A domain listing follows your domain and your link domains wherever you send from. Click tracking adds a link domain of its own, so check whether your sending service has it on.

Outlook.com names its blocks in the bounce: 550 SC-004 means complaints about your IP, and OU-001 sends you to Spamhaus.^[24]

Outlook.com, Microsoft 365 and Yahoo#

Outlook.com, Hotmail and Live addresses#

Domains sending more than 5,000 messages a day to Microsoft’s consumer service must pass SPF and DKIM, and publish DMARC at least at p=none, aligned with one of them.^[25] Since 5 May 2025, mail that falls short is rejected with 550 5.7.515, as the post’s April update and Microsoft’s support page say. An older paragraph of the same post still describes Junk, so plan for rejection.^[26]

Microsoft 365 business mailboxes#

A company on Microsoft 365 filters its own inbound mail under anti-spam policies its admins set. Bulk mail gets a bulk complaint level (BCL), a score of how likely it is to draw complaints, checked against a threshold the admin can change.^[27] That is how the same message reaches the inbox at Outlook.com and Junk at one customer. You cannot change their policy; their IT admin can. A note that works: “Our invoices from billing@example.com land in Junk. Could you check the anti-spam headers on one, and report it to Microsoft as not junk from the Submissions page?”

For their IT admin. In X-Forefront-Antispam-Report, CAT:SPM or SFV:SPM means spam filtering caught it, and SRV:BULK means it was treated as bulk; X-Microsoft-Antispam carries the BCL.^[5]

Yahoo#

Once your mail is DKIM-signed, enrol each DKIM domain in Yahoo’s Complaint Feedback Loop; it then reports each complaint so you can remove the person.^[19]

Recovering after the fix#

No form resets reputation; the mail you send next does.

1. Slow down when receivers push back. The back-off rules for deferrals and 4.7.28 are in the warm-up guide.
2. Restart with your most engaged recipients. Pick them by recent clicks, replies or purchases, not opens, which Apple Mail can record without anyone reading.
3. Fix the cause before the volume returns. A bad list source comes back with the list.
4. Stay on your domain. A fresh domain starts with no reputation, and whatever caused the damage moves with you.
5. Watch the data, not the calendar. Postmaster Tools data is typically updated within 24 hours but can take longer.^[28]

Consent law sits beside filter policy and differs by country; the UK and US rules are in the marketing email guide.

When the headers show dmarc=pass and your seed inboxes agree, add the recipients you paused back in small batches, starting with the most recently active.

For IT and developers: check the records from a terminal#

The Dig page’s checks from a shell (on Windows, nslookup -type=TXT):

# SPF: the domain after smtp.mailfrom= in your header
dig +short TXT mail.example.com
# DMARC: _dmarc under your From domain
dig +short TXT _dmarc.example.com
# DKIM: the s= value from the DKIM-Signature header, then ._domainkey
dig +short TXT selector1._domainkey.example.com

Among the answers you want exactly one starting v=spf1, one starting v=DMARC1, and a DKIM key. Check SPF on the smtp.mailfrom domain, not only the bare domain: that is the name receivers evaluate. ^[14]