Emails going to spam: causes and fixes

First, find out whether it is a domain problem

Send a message from your mailbox to a Gmail account. In Gmail open it, choose "Show original" and look at three lines: SPF, DKIM and DMARC. Each should say PASS. If any of them says FAIL or NONE, or is missing, the cause is in your domain's DNS and the fixes below will remove it.

If all three say PASS and messages still land in spam, the problem is more likely server reputation or content. More on that further down.

The most common technical causes

• No SPF record, or two SPF records at once. With two records the recipient reports a permanent error (permerror) and SPF fails.
• SPF is missing one of the senders. Mail goes out through your mailbox provider, but invoices from the accounting program, a newsletter or a website form leave from other servers that are not in SPF.
• Too many lookups in SPF. The specification allows 10 mechanisms that need a DNS query (include, a, mx, ptr, exists, redirect), counted together with those hidden inside your providers' records. After adding three or four services the limit is easy to exceed, and then SPF stops working.
• DKIM switched off. Most mail providers offer DKIM signing, but you have to enable it in the panel and publish the key in DNS.
• No DMARC. Since February 1, 2024 Gmail requires SPF, DKIM and DMARC (a p=none policy is enough) from senders who send more than 5,000 messages a day to Gmail accounts. From everyone else it requires at least SPF or DKIM. Yahoo has similar rules. A small company rarely reaches that threshold, but growth can get you there quickly, and DMARC protects against spoofing anyway.
• Your own mail server without a PTR record (reverse DNS), or with an IP address on a blocklist. This applies to companies that send mail from their own server or from a website on shared hosting.

Fix it step by step

1. Run the free domain audit (the form below). You will see the state of SPF, DKIM, DMARC and mail server encryption.
2. List every service that sends mail with an address in your domain: mailboxes, invoicing program, online shop, CRM, newsletter, contact form.
3. Build one SPF record that covers them all and end it with "-all", or "~all" while you review. Check it with the SPF checker.
4. Enable DKIM at every provider that supports it and add its records in DNS.
5. Add DMARC with a p=none policy and a report address (rua). After a few weeks of reports, once you know all legitimate mail passes, tighten the policy. Details: DMARC guide.
6. If you send many messages to Gmail inboxes, set up Google Postmaster Tools. It shows the share of messages that Gmail users mark as spam and your compliance with Gmail's requirements. Data appears only at higher volumes.

When DNS is not enough

Correct SPF, DKIM and DMARC do not guarantee inbox placement. Filters also judge the sender's history and how recipients behave. Messages to a purchased address list, no easy unsubscribe in a newsletter, or a sudden jump in volume from a new domain hurt reputation whatever your settings are. It is worth sending bulk mail from a separate subdomain (for example news.yourcompany.com) so its problems do not affect ordinary correspondence.