Why are my emails going to spam?

Your email lands in spam when the receiving mailbox can’t prove the message really came from you. Three records on your domain do the proving: SPF, DKIM and DMARC. You can check all three yourself by sending one message to a Gmail address and opening Show original.

Start with one test: Show original

Send a message from your business address to a personal Gmail account. Open it in Gmail on a computer. Next to Reply, click More, then Show original. Gmail opens the full header in a new window.

Look for the line that starts Authentication-Results. Inside it you’ll find a result for each check: spf=, dkim= and dmarc=. You want pass on all three. A fail, softfail or none tells you which record to fix.

Then run the same test for every other tool that sends mail as your domain. Each one is a separate sender, and each can fail on its own.

List every tool that sends as you

It’s easy to think of your mailbox and stop there. A typical small business also sends from a website contact form, invoicing, a newsletter, a booking tool, and sometimes the office copier. Write them all down before you change a record. This list is what the rest of the fix is built from.

SPF: one record, ten lookups at most

SPF is a single TXT record that lists the services allowed to send as your domain. Two rules from the standard, RFC 7208, catch most people:

• Only one SPF record. If a domain has two, the check returns a permanent error and fails. Merge them.
• No more than 10 lookups. Each include, a, mx, ptr and exists, plus the redirect modifier, counts toward a limit of 10, including the ones inside your providers’ own includes. Go over and SPF fails. Remove services you no longer use before adding new ones.

DKIM: one key per sender

DKIM signs each message so the receiver can tell it wasn’t changed or forged. Every sending service has its own DKIM setting, usually a record you copy into DNS. Turn it on in each tool from your list. Gmail needs keys of 1024 bits or longer, and Google recommends 2048 bits if your provider supports it.

DMARC: start at p=none, then tighten

DMARC tells receivers what to do when a message fails, and it checks alignment: the domain in your From address has to match the domain that passed SPF or DKIM. A starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none changes nothing about delivery. It turns on reports, so you can see every service sending as you. Once all your real mail passes, move to p=quarantine, then to p=reject.

If you’d rather work through it with worksheets, Get your email out of spam is my step-by-step guide for a business with one domain and several sending tools.

Which mailbox rules apply to you

Gmail, Yahoo and Microsoft each publish their own rules. The everyday rules apply to everyone. The stricter ones start at high volume.

Mailbox	Every sender	High-volume senders
Gmail	SPF or DKIM. Valid forward and reverse DNS. A TLS connection. Spam rate below 0.3%, and Google recommends staying below 0.10%.	5,000 or more messages a day: SPF and DKIM, a DMARC record (p=none is accepted), From aligned with SPF or DKIM, one-click unsubscribe on marketing mail.
Yahoo	SPF or DKIM. Valid forward and reverse DNS. Spam rate below 0.3%.	Bulk senders (Yahoo publishes no number): SPF and DKIM, a DMARC record at p=none or stricter that passes, a working unsubscribe header, unsubscribes honored within 2 days.
Outlook.com, Hotmail, Live, MSN	Microsoft’s page covers high-volume senders only.	5,000 or more messages: SPF and DKIM both pass, a DMARC record (p=none is accepted), SPF or DKIM aligned with From. Mail that falls short is rejected.

Last checked October 20, 2026, against Google’s sender guidelines, Yahoo’s sender best practices and Microsoft’s 550 5.7.515 page. These companies change their rules, so their pages are the final word.

Passing all three and still in spam?

Authentication proves who sent the message. It doesn’t prove anyone wanted it. Gmail also weighs how often people mark your mail as spam, and Google Postmaster Tools shows that rate for your domain. Mail only people who asked to hear from you, and make unsubscribing easy. If the rate is climbing, fix that before you touch another record.