Skip to main content
MyIPKit— Your network, explained.

Why your email goes to spam

The causes in the order worth checking them — authentication first, then the sending server, then the message itself — and how to read the verdict a receiver already wrote into your mail.

Updated Sep 25, 20263 min read

Warning:

Before you run anything

These guides are reference material, not instructions for your particular network. Run commands only against networks you own or have explicit permission to examine — in many countries probing a network you are not authorised to touch is a criminal offence regardless of intent. Everything here is provided without warranty: you are responsible for what you run and for its effect on your systems.

When mail lands in spam, the receiving provider has made a judgement about it, and it has usually written that judgement into the message. Reading it first saves a lot of guessing. After that, the causes are worth checking in a particular order, because the early ones make the later ones irrelevant.

Start with the verdict that is already there

Send a message to an account you control at a large provider, open it, and view the full source — Show original in Gmail, View message source in Outlook. Near the top is an Authentication-Results header:

Authentication-Results: mx.example.net;
       spf=pass smtp.mailfrom=example.com;
       dkim=pass header.d=example.com;
       dmarc=pass header.from=example.com

Three passes means authentication is not your problem and you can skip to the sending server. Any fail, softfail, none or permerror tells you where to look.

1. Authentication

This is the most common cause and the cheapest to fix, because it lives entirely in your DNS.

  • SPF lists the servers allowed to send for your domain. Every service that sends as you — your mailbox provider, your newsletter tool, your helpdesk, your website — must be in it.
  • DKIM signs each message with a key published in DNS. Each sending service has its own key to publish.
  • DMARC tells receivers what to do when both of those fail, and asks them to send you reports.

The SPF, DKIM and DMARC check reads all three for any domain and says which part is failing.

The contact-form trap. A website form that sends mail from the visitor’s address — From: someone@gmail.com, sent by your web server — fails authentication by design, because your server is not allowed to send for gmail.com. Send from your own domain and put the visitor’s address in Reply-To instead.

2. The large providers’ rules

Since early 2024 Gmail and Yahoo have required, at minimum, that mail is authenticated with SPF or DKIM, comes from a server whose address has matching forward and reverse DNS, and is sent over TLS. Anyone sending more than about 5,000 messages a day to Gmail must also have SPF, DKIM and a DMARC record, keep complaints below 0.3%, and offer one-click unsubscribe on marketing mail. Other providers have moved the same way.

For a small business sending ordinary mail through a mainstream provider, most of this is handled for you — except the DNS records, which only you can publish.

3. The sending server

If authentication passes, look at where the mail comes from.

  • Reverse DNS. A sending server’s address should resolve back to a name, and that name should resolve to the address. The reverse DNS tool checks the first half.
  • Reputation. Shared hosting and cheap servers send from addresses whose previous tenants may have spammed from them. A mainstream mail provider or a transactional mail service usually has far better reputation than a web server sending on its own.
  • A new domain, or a sudden jump in volume. Receivers are cautious about both. Ramp up gradually.

4. The message itself

Content matters less than people assume once authentication is right, but some things reliably count against you:

  • link shorteners, or links whose visible text shows a different address from where they lead;
  • a message that is one large image with little text;
  • attachments, especially archives and documents with macros;
  • no unsubscribe link on anything resembling marketing.

5. The recipients

The strongest signal of all is how recipients react. Mail that people mark as spam, or never open, drags every later message down with it. Sending to old or purchased lists is the quickest way to get there.

If it still lands in spam

Check again after 48 hours. Changes to DNS records take effect as caches expire — see why a DNS change has not taken effect — and some providers update their view of a sender more slowly still.

Related

All guides