Why Your Emails Go to Spam and How to Fix It

There is a stubborn myth that emails land in spam because you wrote “free” or used too many exclamation marks. That was true fifteen years ago.

Today the filter decides before it reads your copy. It looks at who is sending, whether that domain is authenticated, and what the people who already received your mail think of it. Fail there and it does not matter how good your subject line is.

And the margin just got thinner. In its own documentation, Google warns that “starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic”, with “temporary and permanent rejections” for messages that fall short. This is no longer advice.

Diagnose first, don’t guess

Before changing anything, find out what is actually happening:

Send a test campaign to a Gmail account, an Outlook account and a corporate one. See which ones route it to spam. If only one fails, you have a different problem than if all of them do.
Open the message and read the headers. In Gmail: the three dots → “Show original”. Three lines matter there: SPF, DKIM and DMARC. Each will say PASS or FAIL.
Register your domain in Google Postmaster Tools. It is free and it is the only way to see your real spam complaint rate. Google also added a compliance status dashboard that tells you exactly which requirement you are failing.

If you see a FAIL in step 2, you have found your cause. The rest of this guide is how to fix it.

What a spam filter actually weighs

Three things, in this order:

Authentication. Can you prove the message came from who it claims? That is SPF, DKIM and DMARC.
Reputation. The track record of your domain and the IP you send from. Slow to build, fast to lose.
Engagement. How many people open, reply, delete without reading, or hit the spam button.

Content matters, but far behind these three. That is why a beautifully written campaign goes straight to spam when the domain is not authenticated.

SPF: who is allowed to send as you

SPF is a TXT record in your DNS declaring which servers may send mail using your domain.

Type:   TXT
Name:   @
Value:  v=spf1 include:amazonses.com include:_spf.google.com ~all

Three rules that get broken constantly:

Only one SPF record per domain. If you have two, both fail. Multiple providers all go inside the same record, separated by spaces.
Ten DNS lookups maximum. Every include: counts. Chain too many providers and SPF returns permerror and stops validating at all.
Use ~all (softfail) or -all (fail), never +all, which authorizes anyone on earth to send as you.

DKIM: the signature proving nothing was altered

DKIM attaches a cryptographic signature to each message. The receiver looks up your public key in DNS and confirms the message was not modified in transit.

Your sending provider gives you the record, and it looks like this:

Type:   CNAME
Name:   abc123._domainkey
Value:  abc123.dkim.amazonses.com

That abc123 is the selector, and it causes the most confusion: every provider uses its own. If you send through two services, you need both DKIM records published at once. They do not conflict.

DMARC and alignment: the number one failure

This is where most senders fail, and it is the least intuitive part.

DMARC tells the receiver what to do when SPF and DKIM do not add up. The minimum record is this:

Type:   TXT
Name:   _dmarc
Value:  v=DMARC1; p=none; rua=mailto:reports@yourdomain.com

But DMARC is not satisfied by SPF or DKIM simply returning PASS. It requires alignment: the domain in the From: header your subscriber sees must match the domain validated by SPF or by DKIM.

You can have SPF PASS and DKIM PASS and still get DMARC FAIL. It happens when you send from hello@yourcompany.com but validation happens against your provider’s domain. Technically everything is signed; it just is not signed by you.

The fix is to authenticate your own sending domain on whatever platform you use, instead of leaning on the provider’s shared domain. That is exactly the difference between a generic shared server and sending through your own SMTP with a verified domain.

Always start at p=none, which only observes and sends you reports. Once you have watched your legitimate mail align correctly for a few weeks, move to p=quarantine, then p=reject.

What Gmail and Yahoo require today

Since February 1, 2024, Google requires anyone sending more than 5,000 messages a day to Gmail accounts to:

Set up SPF and DKIM (not one or the other: both).
Publish DMARC, even if only p=none.
Align the From: domain with either SPF or DKIM.
Offer one-click unsubscribe on commercial mail.
Keep the spam complaint rate below 0.3%, with Google explicitly recommending staying below 0.1%.
Use TLS and have valid forward and reverse DNS records.

Yahoo publishes near-identical requirements, plus one worth noting: unsubscribes must be processed within two days.

Two surprises about the 5,000 threshold

Both are in Google’s documentation and almost nobody mentions them:

It counts across your whole domain. The limit is not per mailbox or per tool. Messages from your primary domain and its subdomains count together. If marketing sends 3,000 from promos.yourcompany.com and your app sends 2,500 notifications from yourcompany.com, you are a bulk sender even though neither one is on its own.

The classification never expires. Google states it plainly: senders classified as bulk senders are permanently classified that way. Dropping your volume next month does not undo it.

The practical takeaway: if you will ever come close to that number, set everything up properly from day one.

Real one-click unsubscribe

An “unsubscribe” link at the bottom of the email is not enough. Commercial mail needs these headers, defined in RFC 2369 and RFC 8058:

List-Unsubscribe: <https://yourdomain.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

With those, Gmail shows its own unsubscribe button next to your sender name. Making it easy to leave sounds counterproductive, but it is the opposite: an unsubscribe costs you nothing and a spam complaint costs you a lot. The more visible the unsubscribe button, the fewer people reach for “report spam” instead.

Keep complaints under 0.1%

The 0.3% Google cites is the ceiling, not the target. For perspective: 3 complaints per 1,000 messages already puts you at the limit.

What moves the number most:

Double opt-in on signup forms. Fewer contacts, but contacts who expect you.
A steady rhythm. Disappearing for six months and returning with a mass campaign spikes complaints.
A recognizable sender. The name and domain should be what the person associates with your brand.
Segmentation. Send to people interested in the topic instead of to the whole list out of habit.

Warm up the domain before sending at volume

A new domain has no reputation. If your first send is 50,000 messages, filters assume the worst.

Ramp up over two or three weeks: start with a few hundred, roughly double every couple of days, and check your metrics at each step. Start with your most engaged contacts, the ones who open and reply. Early positive signals are worth a lot.

If you switch providers or move to a new dedicated IP, this process starts over, even if your domain already had a good reputation.

Clean the list without flinching

A dirty list sinks deliverability:

Hard bounces: remove immediately. These addresses do not exist.
Inactive contacts: if someone has not opened anything in six to twelve months, try a re-engagement campaign and remove them if it fails.
Purchased lists: do not use them. They typically contain spam traps, addresses created specifically to catch people who buy databases. Hitting one can block your domain for months.

Shrinking a list is uncomfortable, but 5,000 interested people outperform 50,000 indifferent ones and put far less at risk.

Checklist

Run through this before your next campaign:

SPF published, exactly one record, under 10 DNS lookups
DKIM active with your provider’s selector
DMARC published, at minimum p=none, with a reporting address
The From: domain aligns with SPF or DKIM
List-Unsubscribe and List-Unsubscribe-Post headers present
Domain registered in Postmaster Tools
Complaint rate under 0.1%
Hard bounces removed after every send
Volume growing gradually, no spikes

If all nine are ticked and you still land in spam, then it genuinely might be your content or a pre-existing reputation problem with the domain. But that is far rarer than people assume.

Requirements quoted from Google’s official sender guidelines and Yahoo’s sender best practices, checked in September 2026.