Why Are My Emails Going to Spam? 9 Causes and How to Fix Each One

What it is SPF is a guest list. It's a DNS record that names the servers allowed to send email for your domain. If the server delivering your message isn't on the list, receivers get suspicious.

What goes wrong

• No SPF record at all.
• Two SPF records. A domain can publish only one, and two valid records together produce a permanent error instead of a pass. This happens constantly when someone adds a new tool and pastes a second record instead of editing the first.
• Too many lookups. SPF evaluation is capped at 10 DNS lookups, and each include, a, mx, redirect, and exists mechanism counts toward that cap. Pile up enough "include" entries for your email platform, newsletter tool, CRM, and helpdesk and you cross the line without noticing.

The fix Publish exactly one SPF record that lists every legitimate sender. Common building blocks:

A combined record looks like this: v=spf1 include:_spf.google.com include:yournewslettertool.com ~all. Then run it through any free SPF checker to confirm it passes and stays under the lookup limit.

What it is DKIM is a tamper-evident seal. Your mail system attaches a cryptographic signature to every message, and receivers check it against a public key in your DNS. It proves the message really came from your domain and wasn't altered in transit.

What goes wrong Some platforms don't turn DKIM on automatically for custom domains. Even when a signature exists, it may use your provider's domain instead of yours, which means it can't line up with your From address. Google also requires a DKIM key of at least 1024 bits and recommends 2048 bits where your DNS host supports it.

The fix, by platform

Microsoft 365: Publish two CNAME records (selector1 and selector2) in DNS, then enable signing in the Microsoft Defender portal. The two selectors let Microsoft rotate keys automatically.

Google Workspace: In the Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email. Generate a new record, choose a 2048-bit key, publish the TXT record at your DNS host, and click Start authentication.

What it is DMARC ties SPF and DKIM to the address your recipient actually sees in the "From" line, and it tells receiving servers what to do when a message fails. It also sends you reports showing who is sending mail as your domain.

What goes wrong Google requires bulk senders to publish DMARC, and the policy is allowed to be set to none. A missing record is an easy failure to fix. The other failure is alignment: SPF or DKIM passes, but for a domain that doesn't match your From address. Google states that the From domain must align with the SPF domain or the DKIM domain to pass DMARC.

The fix Publish a starter record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The p=none setting changes nothing about delivery. It simply turns on reporting so you can see every source sending as your domain.

Do not jump straight to a strict policy. Google's own rollout advice is to set up SPF and DKIM at least 48 hours before DMARC, run p=none for about a week while reviewing reports, then move to quarantine for a small percentage of messages and increase gradually.

Jumping straight to reject is where domains lose their own mail, because any legitimate sender still failing alignment gets refused almost immediately.

What it is Your email system isn't the only thing sending mail "from" your domain. Newsletter platforms, CRMs, invoicing software, helpdesks, scheduling tools, and website contact forms often send on your behalf.

What goes wrong If those tools aren't covered by your authentication, they fail it. Google warns that messages from third-party senders missing from your SPF record are more likely to be marked as spam. This is why you'll often hear, "Our emails are fine, but the newsletter keeps going to spam."

The fix

1. Make an inventory of every tool that sends email using your domain.
2. Add each one to your SPF record (watch the 10-lookup limit from Cause 1).
3. Set up DKIM signing for your domain inside each tool, usually under a setting called "domain authentication" or "sender verification."
4. Let DMARC reports find the stragglers. The rua reports in your DMARC record list every source sending mail as your domain, including tools you forgot about.

What it is Even perfectly authenticated mail gets filtered if recipients keep reporting it. Google notes that frequent spam reports lower your domain's reputation over time.

The numbers Google tells senders to keep their user-reported spam rate below 0.1% and never let it reach 0.3% or higher. At 0.3%, that is about three complaints per 1,000 delivered messages. It sounds tiny because it is, which is why a single poorly targeted campaign can do real damage.

The fix

• Email only people who asked. Google's guidance is to make sure recipients opt in and to confirm each address before subscribing it.
• Make leaving easy. Marketing and subscribed mail needs a visible unsubscribe link, and senders above 5,000 messages a day must support one-click unsubscribe. Hiding the unsubscribe button just converts unsubscribes into spam reports.
• Prune your list. Google suggests considering removing recipients who never open or read your messages.
• Measure it. Register your domain with Google Postmaster Tools at postmaster.google.com to see your spam rate and domain reputation. Be aware that low-volume senders may not generate enough Gmail traffic for data to appear.

What it is Blocklists are databases of IP addresses and domains linked to spam or abuse. Mail servers check them during the connection itself, so a listed sender can be blocked before the message is even delivered.

The fix

1. Check Spamhaus first. Enter your sending IP and your domain at check.spamhaus.org, which names the list, the reason, and the removal steps.
2. Check more than the IP. A domain-based listing won't clear if you simply change IP addresses, so check the IP, sending hostname, return-path domain, From domain, DKIM domain, and any link domains in the message.
3. Fix the root cause before asking for removal. Compromised accounts, bad lists, or an infected device will get you listed again.
4. Then request removal. Removal is free, and requests are reviewed manually, so allow some time.

If you send through a shared IP from an email service provider, Google advises making sure that shared IP isn't on any blocklist, since other customers' behavior affects everyone on it.

What it is If criminals send phishing mail pretending to be you, or take over a real mailbox, the resulting complaints and blocklistings land on your reputation.

Warning signs

• Bounce messages for emails you never sent
• Customers asking about a strange message "from you"
• Unknown sources showing up in your DMARC reports
• A sudden spike in spam complaints with no change in your own sending

The fix

1. Reset passwords on affected accounts and turn on multi-factor authentication.
2. Check each mailbox for forwarding rules and inbox rules you didn't create.
3. Review recent sign-in activity for unfamiliar locations.
4. Move your DMARC policy toward enforcement, because at p=reject spoofed mail never arrives.

For the bigger picture on why attackers target small businesses, see our phishing and BEC statistics roundup.

What it is Beyond authentication, receivers check basic hygiene. Google's guidelines include several items that trip up small senders:

• One address in the From header. Google says the From header should include only one email address.
• Properly formatted messages. Messages should follow the Internet Message Format standard (RFC 5322), and HTML email should follow HTML standards.
• No impersonating Gmail. If a tool sends mail with your @gmail.com address in the From line, Google says Gmail will begin applying a DMARC quarantine policy to Gmail From headers, which can send those messages to spam.
• Valid reverse DNS. Sending servers should have valid forward and reverse DNS (PTR) records, and encrypted TLS delivery is expected.

The fix Send from an address on your own domain, keep message formatting clean, and if you run your own mail server or a dedicated IP, ask whoever manages it to confirm the PTR and TLS settings.

What it is Authentication records describe your setup at one moment in time. When the setup changes, the records can quietly go stale.

What goes wrong after a migration or platform switch

• Your SPF record still names the old provider and doesn't include the new one.
• DKIM was never set up for the new platform.
• The new platform sends from different servers than the ones your DNS authorizes.
• A well-meaning DNS cleanup removed a record that something still depended on.

If your spam problem began within days of moving platforms, this is the first place to look. Work through Causes 1 to 3 against your current provider, and delete leftovers from the old one. If you're planning a move, build authentication into the plan from day one using our step-by-step guides for migrating from Google Workspace to Microsoft 365 or from Microsoft 365 to Google Workspace.