"Why are my emails going to spam?" is one of the most common questions we get, and it almost never has a single answer. Spam filters at Gmail, Microsoft and Yahoo weigh dozens of signals: who you are, how you authenticate, how recipients react to your mail, and what the message looks like. One weak signal is often tolerated. Two or three together send you to the junk folder.
The good news is that the causes are predictable. Work through this checklist in order. The first items are the most common and the easiest to fix.
Start with a test message
Before changing anything, send a normal message from the affected mailbox to a personal Gmail address and an Outlook.com address. Open each one and view the full headers (in Gmail, "Show original"). Look for the Authentication-Results line. It tells you whether SPF, DKIM and DMARC passed and for which domain. That single line answers the first three checks below.
1. SPF is missing, broken or over the limit
SPF is a DNS record listing the services allowed to send for your domain. Common failures:
- No SPF record at all.
- Two SPF records instead of one, which invalidates both.
- More than 10 DNS lookups across all the
include:entries, which causes a permanent error and makes SPF fail for every message. - A sending tool that was never added.
2. DKIM is not turned on
DKIM signs each message so receivers can verify it came from you. Microsoft 365 and Google Workspace both require you to turn it on for your custom domain and publish DNS records. Many businesses never do, and their mail has gone out unsigned for years. Our step-by-step guide to DKIM setup on Microsoft 365 and Google Workspace walks through both.
3. DMARC is missing or misaligned
DMARC checks that SPF or DKIM passed for the same domain shown in the From address. Google and Yahoo require a DMARC record (at least p=none) and alignment for anyone sending more than 5,000 messages a day to their users, and Microsoft enforces similar rules for high-volume senders to Outlook.com addresses. Below those volumes, a missing or failing DMARC still counts against you.
The usual culprit is a third-party tool such as a CRM, newsletter platform, helpdesk or website form sending as your domain without DKIM set up. See SPF, DKIM and DMARC Explained for how to authenticate each one.
4. Your list has bad addresses
Sending to addresses that do not exist produces bounces, and high bounce rates tell providers you are not maintaining your list. Old purchased lists are the worst offenders, but even good lists decay as people change jobs.
- Remove hard bounces immediately.
- Verify any list you have not mailed in months before sending to it.
- Never mail a purchased list from your main domain.
5. Recipients are marking you as spam
Spam complaints are one of the strongest negative signals. Google says to keep your reported spam rate below 0.1% and never let it reach 0.3%. Yahoo also sets a 0.3% ceiling. That is a small margin: three complaints per thousand messages.
Complaints usually come from people who do not remember signing up, cannot find the unsubscribe link, or are getting mail more often than they expected. Make the unsubscribe link obvious and honor it fast.
6. No one-click unsubscribe on marketing mail
For senders above 5,000 messages a day, Gmail and Yahoo require marketing and subscribed messages to include a one-click unsubscribe header (List-Unsubscribe with List-Unsubscribe-Post) in addition to a visible link, and to process unsubscribes within two days. Most email platforms add the header for you, but check, especially if you send through a custom system or a CRM's sales sequences.
7. You changed volume suddenly
Providers judge new or quiet senders cautiously. A mailbox that normally sends 30 messages a day and suddenly sends 2,000 looks like a compromised account or a spammer. The same applies to a brand new domain.
Increase volume gradually over several weeks, and keep sending steady. If you are launching a new domain or mailbox for outreach, plan a warm-up period first. We cover timing in Email Warm-Up: How Long It Takes and What Actually Matters.
8. Your content or links look like spam
Content matters less than it used to, but some patterns still hurt:
- Link shorteners and links to domains with poor reputations.
- Links whose visible text shows one domain while the link goes to another.
- A single large image with little or no text.
- Attachments from cold senders, especially archives and macro-enabled files.
- Too many links in a short message.
- Tracking domains shared with thousands of other senders. Many platforms let you set up a custom tracking domain on your own subdomain.
Plain, specific, human-sounding messages get delivered. Templates that look like everybody else's do not.
9. Your domain or IP is on a blocklist
If your domain or sending IP lands on a major blocklist, some receivers will junk or reject your mail outright. Check your domain and your sending IPs with a multi-blocklist lookup tool. If you send through Microsoft 365, Google Workspace or a major email platform, the IP is shared and the platform usually handles delisting. If the listing is on your own domain, find and fix the cause (often a compromised account or a form being abused) before requesting removal.
10. Your reputation with the provider is low
Gmail and Microsoft both track sender reputation based on how their users engage with your mail over time: opens, replies, deletes without reading, moves to spam, and moves out of spam. You can see some of this directly:
- Google Postmaster Tools shows spam rate and authentication for mail sent to Gmail users once you verify your domain and send enough volume.
- Microsoft's Smart Network Data Services (SNDS) shows data for IP addresses you control, which mainly helps if you have dedicated sending IPs.
Reputation recovers slowly. The fix is consistent: send only to people who want your mail, at a steady pace, and stop mailing people who never engage.
A few less obvious causes
- Website forms that email you notifications "from" the visitor's address. Your own server is spoofing someone else's domain, and it fails their DMARC. Send from your own domain and put the visitor's address in Reply-To.
- Mail forwarding rules that pass messages from one provider to another can break SPF and land legitimate mail in spam on the receiving side.
- Sending sales outreach and day-to-day client mail from the same domain. If outreach hurts reputation, your invoices and proposals suffer too. That is why we run cold outreach mailboxes on separate domains with ongoing warm-up and track weekly warm-up health scores for each one.
Where to start
If you only have an hour, do this:
- Send a test message and read the Authentication-Results header.
- Fix any SPF, DKIM or DMARC failure it shows.
- List every tool that sends email as your domain and confirm each one is authenticated.
- Remove hard bounces and check that unsubscribe works.
That fixes the majority of cases we see. If mail still lands in spam after authentication is clean, the problem is reputation or list quality, and that takes a steadier, longer fix.
How we help
Our email deliverability service covers the full checklist: authentication across every sender, DNS cleanup, list hygiene, warm-up for new domains and mailboxes, and monitoring so problems show up in a report before they show up in your pipeline.
Frequently asked questions
Why do my emails go to spam in Outlook but not Gmail?
Each provider runs its own filters and its own reputation data. Microsoft is often stricter with new or low-volume senders, and missing DKIM on Microsoft 365 is a common cause. Check authentication in the Outlook copy's headers first, then look at volume and engagement.
Why are my emails going to spam for one customer only?
That usually points to the recipient's own filtering, such as a corporate security gateway or a rule that quarantines external mail. Ask the recipient's IT team to check their quarantine and add your domain to their allow list, and confirm your authentication passes.
How long does it take to fix spam folder placement?
Authentication fixes take effect as soon as DNS updates, usually within hours. Reputation problems take longer, typically weeks of steady, wanted mail before placement improves.
Will a paid email service fix my deliverability?
Not by itself. A good platform gives you clean infrastructure and tools like one-click unsubscribe, but authentication, list quality and how recipients react to your mail are still on you.
Do spam trigger words still matter?
Much less than they once did. Modern filters rely far more on authentication, reputation and engagement. Write clearly and honestly and focus on the technical items above.