Why is my email going to spam, and how do I fix it?

21 June 2026 · 13 min read

Few problems are as quietly damaging as legitimate email landing in the spam folder. You send an invoice, a password reset, a newsletter or a one-to-one reply, and the recipient never sees it because a filter quietly diverted it. No bounce, no error, no warning: the message simply does not arrive where a human will read it. Worse, spam-foldering is rarely caused by one obvious fault. It is usually the sum of several smaller weaknesses, each of which nudges a receiving mailbox provider towards "probably unwanted". This article walks through the real causes in the order they tend to matter, then gives you a prioritised fix list you can work through today. We will be specific and technical where it counts, because vague advice ("warm up your domain", "improve engagement") is exactly what keeps people stuck.

The first thing to understand is who decides. You do not control whether your mail reaches the inbox. The receiving provider does: Gmail, Microsoft 365 and Outlook.com, Yahoo, Apple's iCloud Mail, and the spam engines used by corporate gateways. Each of them runs your message through a scoring process before deciding inbox, spam folder, or outright rejection. That score blends several independent signals, and the unhelpful truth is that no single signal guarantees the inbox. But some signals are gatekeepers: get them wrong and almost nothing else you do will rescue you. Authentication is the biggest of these gatekeepers, so we start there.

Cause one: your authentication is missing, misaligned or failing

Before a provider looks at your content or your reputation, it asks a simpler question: can this domain prove the message is really from it? Three standards answer that question, and they have to work together.

SPF (Sender Policy Framework) lists the servers allowed to send for your domain. It is published as a TXT record in DNS and checked against the hidden envelope sender of each message.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each message, proving it was signed by your domain and has not been altered in transit.
DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM back to the visible "From" address your recipients actually see, and tells receivers what to do when a message fails.

Here is the part most people miss: passing SPF or DKIM is not the same as passing DMARC. DMARC requires alignment. The domain that passes SPF, or the domain that signed with DKIM, must match the domain in the visible From address. A message can pass raw SPF on mail.somevendor.com and still fail DMARC, because that is not your domain. This is the single most common reason that "I set up SPF, why is my mail still flagged?" If you have never seen your own alignment results, run your domain through the free DMARC checker and the DMARC report analyzer: the aggregate reports will show you, source by source, which of your sending services pass DMARC and which do not.

Authentication gaps that commonly cause spam-foldering:

No DMARC record at all. Gmail and Yahoo now require bulk senders to publish at least p=none. Even below the bulk threshold, an unauthenticated message is treated with suspicion because the provider cannot tell your mail from a spoof of you. Generate a starting record with the DMARC generator.
SPF that returns PermError. An SPF record may trigger at most ten DNS lookups when evaluated. Add enough sending services and you quietly exceed it, at which point SPF returns PermError and many receivers treat your mail as if SPF were never set up. Check your lookup count with the SPF checker. The fix is flattening, explained in automatic SPF flattening.
DKIM not signing, or signing with the wrong domain. If a sending service signs with its own domain rather than yours, the signature passes but does not align, so it does not help your DMARC result. Confirm what is actually being signed with the DKIM checker.
A new sending tool nobody added to your records. Marketing adds a new newsletter platform, finance adds an invoicing tool, and neither tells whoever manages DNS. The new source fails authentication from day one. Aggregate reports catch this; guessing does not.

Authentication is where you start because it is binary and fixable. You cannot argue your way past a hard SPF or DMARC failure with better subject lines. Get to the point where your real mail streams pass DMARC with alignment, then move on. Our requirements page sets out exactly what Gmail, Yahoo and Microsoft now expect.

Cause two: your domain or IP reputation has slipped

Once a message authenticates, the provider asks the next question: do we trust this sender based on history? Reputation is the running score a mailbox provider keeps for your sending domain and the IP addresses you send from. It is built from how recipients have reacted to your mail over weeks and months, and it is the single biggest factor once authentication is in order.

Reputation is damaged by patterns, not one-off events:

Spam complaints. Every time a recipient clicks "report spam", that is a strong negative signal. A complaint rate above roughly 0.3% will get you throttled or spam-foldered by Gmail; sustained complaints above that are a serious problem. Yahoo and Gmail's bulk-sender rules name this 0.3% figure explicitly, and ask you to stay well below it.
Sending to dead addresses. A high bounce rate from invalid or abandoned mailboxes tells providers you are not maintaining your list, which is a hallmark of bought or scraped data.
Spam-trap hits. Some addresses exist only to catch senders mailing without permission. Hitting them is one of the fastest ways to wreck a domain's standing.
Sudden volume spikes. A domain that normally sends 500 messages a day suddenly sending 50,000 looks compromised, even when it is just an unannounced campaign.
A cold domain or IP. Brand-new sending domains and freshly assigned IPs have no track record, so providers default to caution until you build one. This is the legitimate kernel behind "warming up".

You cannot see a provider's internal reputation directly, but you can see its proxies. Google Postmaster Tools shows Gmail's view of your domain reputation, spam rate and authentication pass rates; Microsoft has its Smart Network Data Services. Use them. From the public side, check whether your sending IPs or domain appear on major blocklists with the blacklist checker, and get an overall view with the deliverability score tool. If you are on shared infrastructure, such as a marketing platform's pooled IPs, remember that your reputation is partly hostage to everyone else on that pool, which is an argument for a dedicated IP once your volume justifies it.

The honest part about reputation: it is slow to build and slow to repair. There is no button that resets it. You earn it back by sending wanted mail to engaged people, consistently, for weeks. That is why the fixes later in this article emphasise list hygiene and consistency over clever tricks.

Cause three: your content and formatting trip the filters

Content matters, but far less than the internet folklore suggests. You will read that certain "spam trigger words" doom your mail. In modern filtering this is mostly overstated: providers use statistical and machine-learned models trained on billions of messages, not a fixed banned-word list. A legitimate, authenticated sender with a good reputation can write "free" and "act now" and still reach the inbox. That said, several content patterns genuinely raise risk because they correlate with bad mail.

Things that genuinely hurt:

Image-heavy, text-light messages. A single large image with almost no real text is a classic spammer pattern, because it hides content from text-based filters. Keep a healthy ratio of real, selectable text to images.
Broken or mismatched HTML. Malformed markup, hidden text, white-on-white tricks, and inline styles that try to obscure content all push your score up. Send clean, well-formed HTML with a matching plain-text alternative (a multipart/alternative message).
Link reputation. Filters check the domains you link to. Public URL shorteners, links to domains with poor reputation, and a mismatch between the link text and the actual destination are all penalised. Link to your own domain where you can.
Mismatched or missing branding signals. If your From domain, your reply-to and your link domains all differ wildly, the message looks less trustworthy. Consistency reads as legitimacy.
Attachments people fear. Executables, password-protected archives and certain document types are filtered aggressively because they are common malware vectors.

A useful discipline: send yourself the message and read the raw source. The email header analyzer will show you the authentication results, the structure and the headers exactly as a receiver sees them, which often reveals a signing or formatting problem you would never spot in a pretty preview.

Cause four: poor list hygiene and weak engagement

Mailbox providers increasingly judge you by how recipients behave. If people open, reply, and move your mail out of spam, your reputation rises. If they ignore or delete you unread, it falls. This is engagement, and for promotional and newsletter mail it has become decisive.

Where list hygiene goes wrong:

Mailing people who never asked. Bought, scraped or "appended" lists are full of uninterested recipients and spam traps. They generate complaints and damage everyone who shares your sending infrastructure. The only durable list is one of people who explicitly opted in.
Never removing the disengaged. Recipients who have not opened anything in six or twelve months are dead weight that drags your engagement metrics down. Sunset them: reduce frequency, send a re-engagement message, then stop mailing the silent ones. A smaller list that engages beats a huge list that does not.
No easy unsubscribe. When unsubscribing is hard, people hit "report spam" instead, which is far more damaging to you than a quiet opt-out. The bulk-sender rules now require one-click unsubscribe (see the next section), and it is in your own interest.
Inconsistent sending. Long silences followed by bursts confuse reputation models. A steady cadence to an engaged audience is what providers reward.

List hygiene is unglamorous and it is where the largest, most durable deliverability gains usually live for anyone sending in bulk. You are, in effect, training the provider's model on every send: each message either teaches it that your mail is wanted or that it is not.

Cause five: you are tripping the bulk-sender rules

In February 2024, Gmail and Yahoo introduced shared requirements for anyone sending roughly 5,000 or more messages a day to their users, and Microsoft has since announced equivalent enforcement for Outlook.com and Hotmail. These are not suggestions. Fail them as a bulk sender and your mail is throttled or rejected outright. The core requirements:

Authenticate with SPF, DKIM and DMARC. You must publish a DMARC policy (at minimum p=none) and align at least one of SPF or DKIM with your From domain. This is the floor, not the ceiling.
Offer one-click unsubscribe. Bulk promotional mail must include List-Unsubscribe and List-Unsubscribe-Post headers so recipients can opt out in a single click, and you must honour those requests within two days.
Keep your spam complaint rate low. Stay below 0.3%, and ideally well under 0.1%. Cross 0.3% and you will see deliverability collapse quickly.
Send authenticated mail from a domain whose DNS resolves correctly, with valid forward and reverse DNS (PTR) records on your sending IPs. Check your reverse DNS with the PTR record checker.

If you send in volume and have not audited yourself against these rules, that is very likely your problem right now. The requirements page breaks them down provider by provider, and the DMARC checker confirms whether your policy meets the authentication floor.

The prioritised fix list

Work through these in order. Earlier items are gatekeepers; there is little point optimising content while your mail is failing DMARC.

1. Fix authentication first, and confirm alignment

Publish SPF, DKIM and DMARC for every domain you send from, including subdomains and any domains you do not send from at all (those should publish a reject policy so they cannot be spoofed). Then prove it works:

Run the DMARC checker, SPF checker and DKIM checker on your domain.
Turn on DMARC aggregate reporting and read the results in the DMARC report analyzer. You are looking for every legitimate sending service to pass DMARC with alignment. Anything failing is either a misconfiguration to fix or a sender to remove.
If SPF is near or over the ten-lookup limit, flatten it rather than deleting includes. See hosted SPF.

This is the highest-leverage work you can do, and it is the foundation everything else sits on. Our done-for-you DMARC enforcement does exactly this end to end if you would rather not hand-edit DNS.

2. Reach a DMARC enforcement policy safely

p=none satisfies the bulk-sender floor but does nothing to stop spoofing, and spoofed mail in your name damages your reputation with the very providers you are trying to impress. The goal is p=quarantine and then p=reject, reached gradually so you never block your own legitimate mail. The safe path is: monitor at p=none until reports show all real sources aligned, ramp the pct tag upward, move to quarantine, then reject. This is the journey our DMARC product automates, and it is described step by step in the enforcement journey. Do not jump straight to reject before your reports are clean; that is the one move that can cause a self-inflicted outage.

3. Audit and repair your reputation

Enrol in Google Postmaster Tools and Microsoft SNDS and watch your domain reputation and spam rate.
Check the blacklist checker for your domain and sending IPs, and follow each listing's delisting process after you have fixed the cause.
If you share an IP pool and your numbers are good but deliverability is poor, consider a dedicated IP, and warm it gradually.
Get a combined snapshot from the deliverability score.

4. Clean your list and respect engagement

Mail only people who opted in. Delete bought and appended data.
Remove or sunset recipients who have not engaged in six to twelve months.
Make unsubscribing trivial, and add List-Unsubscribe and one-click List-Unsubscribe-Post headers to bulk mail.
Send on a steady cadence rather than in occasional bursts.

5. Tidy content and structure

Send multipart/alternative with a real plain-text part alongside your HTML.
Keep a sensible text-to-image ratio and clean, valid markup.
Link to reputable domains, ideally your own, and avoid public URL shorteners.
Read the raw message with the email header analyzer before a big send.

6. Cover the supporting DNS and transport hygiene

Ensure your sending IPs have valid reverse DNS with the PTR record checker.
Publish MTA-STS so receiving servers know to require TLS to your domain, and check it with the MTA-STS checker.
Consider BIMI once you are at p=quarantine or p=reject: it displays your logo in supporting inboxes, which lifts recognition and trust, and you can validate it with the BIMI checker.

A note on forwarding, and why it muddies the picture

If your mail reaches some recipients fine but fails for others, forwarding may be the culprit. When a message is forwarded, the forwarding server becomes the new sender, which breaks SPF, and any change to the message in transit can break DKIM. The result is a legitimate message that fails DMARC at the final destination through no fault of your sending setup. This is normal and expected, and it is one reason DMARC reports show occasional failures from sources you do not recognise. It is not, by itself, a sign that your configuration is broken, and you should not loosen a good policy to accommodate it. The mechanics, and the ARC standard that helps mailbox providers preserve a prior authentication result across a hop, are covered in our material on why forwarding breaks authentication. The practical takeaway: judge your setup by whether your direct mail streams pass DMARC with alignment in aggregate reports, not by isolated forwarded failures.

Putting it together

Spam-foldering is almost never one thing. It is authentication that does not align, plus a reputation that has drifted, plus a list that includes people who never wanted to hear from you, plus content patterns that nudge the score upward. The good news is that the order of attack is clear. Fix authentication so receivers can prove your mail is yours and reach a safe DMARC enforcement policy. Repair and protect reputation by mailing wanted mail to engaged people and watching the provider postmaster tools. Keep your list clean and your unsubscribe honest. Tidy the content last, because it matters least. Do these in order and you remove, one by one, every reason a provider has to doubt you.

If you would rather not assemble and maintain all of this yourself, DMARC Engine is built to do exactly this: it takes a domain from p=none to p=reject without breaking legitimate mail, hosts and flattens your SPF, manages DKIM, publishes MTA-STS and BIMI, and emails you when something changes. Start by running your domain through the free DMARC checker to see precisely where you stand, then read the enforcement journey for the route from where you are to a protected, deliverable domain. When you are ready to act, the dashboard at app.dmarcengine.com walks you through each step with your own data in front of you.