Why Are My Emails Going to Spam? Causes, Checks, and Fixes

You sent the email. Your mail service says it was delivered. The recipient found it in their spam folder, or never found it at all. "Delivered" only means the receiving server accepted the message. It says nothing about where the message was filed.

Emails go to spam for specific, diagnosable reasons, and the receiving server writes most of the evidence into the message headers. This guide covers how to tell whether you have a spam problem, how to read that evidence, the three causes in order of likelihood, and what to do about each.

First, confirm you have a problem

Spam filtering is silent, so you usually notice it indirectly:

• Replies dry up. People who normally respond stop responding, especially if the drop is sudden, spans several recipients, and follows a change to your email setup.
• Someone tells you. A client says your message was in their junk folder, or asks why you never replied when you did. If one person says it, others experienced it and said nothing.
• Open rates fall. For newsletters and marketing mail, a sudden drop that coincides with a domain or infrastructure change points at filtering. Apple Mail Privacy Protection makes open rates noisy, so look for changes in the pattern rather than the absolute number.
• Bounces rise. Some filters reject outright instead of accepting into spam. A bounce rate that climbs for one provider is a clue.
• Mail arrives late. Messages that get extra scrutiny sit in queues. Delivery delays of hours suggest the receiver is unsure about you.

The ten-minute check

Before you investigate anything, get hard evidence.

1. Send a real message from your production setup to mailboxes you control at Gmail, Outlook.com, Yahoo, and iCloud. Use the same sending service, the same From address, and content typical of what you normally send.
2. Check where each one landed. Inbox, spam, or, in Gmail, the Promotions tab. Promotions is not spam.
3. Open the full headers. In Gmail: open the message, then the three-dot menu, then "Show original". In Outlook.com: three-dot menu, then "View message source". In Yahoo: three-dot menu, then "View raw message".
4. Find the Authentication-Results line and read it against the worked examples below.
5. Run the DNS checks. SPF, DKIM, DMARC, and a blacklist check on the domain and sending IP.

Worked example: reading the header

Here is what a failing message typically looks like when Gmail receives it:

Authentication-Results: mx.google.com;
       spf=softfail (google.com: domain of transitioning [email protected] does not designate 203.0.113.55 as permitted sender) [email protected];
       dkim=none (message not signed) header.i=none;
       dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=example.com

Read it line by line:

• spf=softfail with "does not designate 203.0.113.55 as permitted sender": the message was sent from an IP that your SPF record does not list. Someone added a new sending service and never updated SPF. The ~all in the record turned a hard failure into a softfail, which is why the mail was accepted at all.
• dkim=none (message not signed): the sending service is not signing with your domain. Either DKIM was never set up for this service or it is signing with its own domain instead of yours.
• dmarc=fail: with SPF failing and no DKIM, DMARC has nothing to pass on. p=NONE means you asked receivers to take no action, so Gmail delivered the message, but it delivered it to spam because it could not verify you.

That single header tells you the whole story: an unauthorised sending source and no DKIM. Both are DNS fixes. There is nothing to investigate about content or reputation until those are done.

Now the other case, everything passing but the message still in spam:

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 198.51.100.24 as permitted sender) [email protected];
       dkim=pass [email protected] header.s=k1 header.b=Ab12Cd34;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com

Authentication is perfect. Gmail knows exactly who you are and still filed the message as spam. That means the decision was about reputation or engagement, not identity. Go straight to Postmaster Tools, blacklist status, and your complaint and bounce numbers. Content is the last thing to look at.

How worried should you be?

Low concern: a single message to a single recipient went to spam, or marketing mail landed in Gmail's Promotions tab, or cold outreach to people who have never heard of you was filtered. Each is the filter behaving normally.

Medium concern: reports from several recipients in a short period, consistent spam placement at one provider but not others, or problems that started after you changed ESP, added a sending service, or touched DNS.

High concern: authentication failing in headers, a blacklist listing, test messages going to spam at more than one provider, or customers reporting missed mail that affected transactions.

The three causes, in order of likelihood

Every spam problem falls into one of three buckets. Most senders jump straight to worrying about content and trigger words. That is the least likely cause.

1. Authentication failures: the most common and the most fixable

Authentication tells receivers you are allowed to send from your domain. Without it, your mail is indistinguishable from someone impersonating you, and providers increasingly refuse to guess.

SPF (Sender Policy Framework) lists the servers permitted to send for your domain. It fails when there is no record, when a new sending service was never added, when the record exceeds the ten-lookup limit, or when a typo invalidates it. See SPF fail explained.

DKIM (DomainKeys Identified Mail) signs each message so receivers can verify it was not altered and really came from you. It fails when signing is not enabled, when the public key is not in DNS, when the key in DNS does not match the signing key, or when the selector is wrong. See DKIM fail.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties the two together, requires that the passing one aligns with your From domain, and tells receivers what to do on failure. It fails when there is no record, when neither SPF nor DKIM aligns, and it is toothless at p=none. See DMARC fail.

Gmail and Yahoo have required all three from bulk senders since February 2024, and Microsoft since May 2025. Unauthenticated bulk mail is now rejected or junked as policy, not as a judgement call.

2. Reputation: the slow-building problem

With perfect authentication, your mail can still be filtered because providers track how recipients treat it and predict whether the next message is wanted.

The signals they watch:

• Complaint rate. Recipients marking you as spam. Gmail's threshold is 0.3%, and anything above 0.1% is already hurting you.
• Bounce rate. Mail to invalid addresses signals a bad or old list. Keep it under 2%.
• Engagement. Mail that is never opened teaches the filter that nobody wants it.
• Blacklist listings. Your domain or IP on a list such as Spamhaus. Listings follow complaints, spam trap hits, compromised accounts, or a bad neighbour on a shared IP.
• Volume spikes. A sudden jump looks like a compromised account or a spam run.

Authentication is fixed in minutes. Reputation is rebuilt over weeks: clean the list, mail only engaged recipients, warm up gradually, get delisted, and let positive history accumulate. See email sender reputation.

3. Content: the overhyped problem

Modern filters rarely send authenticated mail from a reputable sender to spam on content alone. Content is a tiebreaker for borderline mail, not a primary cause. The patterns that can tip a borderline message:

• Subject lines in capitals, with stacked punctuation, or with a fake "Re:" or "Fwd:"
• Image-heavy messages with almost no text
• URL shorteners, dozens of links, or links whose display text does not match the destination
• Missing unsubscribe link or physical address in marketing mail
• HTML with no plain-text alternative

Good content will not save mail that fails authentication. Bad content can push mail that is already borderline over the edge.

Fixing it

If authentication is failing

• SPF missing or incomplete: create or update the record to include every service that sends as your domain. Over the lookup limit: consolidate or flatten. See SPF too many lookups.
• DKIM missing or invalid: get the record from the sending service, publish it with the correct selector and record type, and enable signing.
• DMARC missing: publish v=DMARC1; p=none; rua=mailto:[email protected] to start receiving reports. Once SPF and DKIM pass and align for all legitimate sources, move to p=quarantine. See DMARC p=none explained.

If you are blacklisted

Each list has its own process. Find out why you were listed (the listing page usually says), fix the cause, submit a removal request, and monitor for relisting. Some listings expire on their own; Spamhaus and Barracuda require you to act. See the blacklist removal guide.

If reputation is the issue

Remove invalid and unengaged addresses, cut frequency or let subscribers choose it, make unsubscribing obvious, and send to your most engaged recipients first to rebuild positive signals. If you share an IP, consider a dedicated one so another sender's behaviour stops affecting yours.

If content is tipping borderline mail

Fix the formatting patterns above, add a plain-text part, replace shortened links with full URLs, and make sure marketing mail carries a working unsubscribe link and a postal address.

Provider specifics

Gmail, Outlook, and Yahoo each filter differently, and a problem at one is not a problem at all. If mail is filtered at only one provider, check that provider's own tools: Google Postmaster Tools for Gmail, SNDS for Microsoft, and the complaint feedback loop for Yahoo. See why Gmail marks emails as spam and Outlook deliverability issues.

When problems go undetected

The worst part of spam filtering is that both sides assume everything is fine. You think the message arrived. The recipient thinks you never wrote. By the time someone mentions it, weeks of mail may have been filtered, and the engagement loss has damaged your reputation further.

Catch it early. Monitor authentication records for accidental changes, watch complaint and bounce rates after every send, keep the list permission-based, and add every new sending service to SPF and DKIM before it sends. See how to test email deliverability for a repeatable check.

Stop Worrying About Email Deliverability

The Email Deliverability Suite monitors your SPF, DKIM, DMARC, MX records and blacklist status daily. Get alerts when something breaks, before your emails stop arriving.