Why Are My Emails Going to Spam? A Diagnosis Checklist

Step 1: Get a real message and look at the verdict

Before guessing, send a normal email from your business address to a Gmail or Outlook.com account you control, find it in Spam, and open the full headers (in Gmail: the three-dot menu → Show original). Gmail prints a summary box at the top with SPF, DKIM and DMARC each marked PASS or FAIL.

If any of the three fails, stop here and fix authentication first — content tweaks will not help a message the receiver cannot authenticate. If all three pass, the problem is reputation, content or recipient behaviour, and the later steps apply.

Step 2: Check SPF, DKIM and DMARC are published and aligned

Run your domain through a DNS lookup such as our free DNS checker and confirm all three records exist. Then check the details that commonly break them:

• SPF: exactly one TXT record starting v=spf1, covering every service that sends as you (your mailbox provider, CRM, invoicing tool, website contact form). Two SPF records is a permerror and counts as a fail.
• SPF: no more than 10 DNS lookups once every include: is expanded — over the limit is also a permerror.
• DKIM: the selector in the DKIM-Signature header (the s= tag) must have a public key published at selector._domainkey.yourdomain.com.
• DMARC: a TXT record at _dmarc.yourdomain.com, at least v=DMARC1; p=none; with an rua= address so you receive reports.
• Alignment: DMARC only passes if the domain in your visible From: matches the domain SPF checked (Return-Path) or the domain DKIM signed (d=). A third-party tool signing with its own domain passes DKIM but fails DMARC.

Step 3: Account for a new domain or a sudden volume jump

A domain registered last week has no sending history, so providers treat it cautiously. The same happens when an established domain goes from 20 messages a day to 2,000. Filters reward consistency: steady, modest volume to people who reply builds reputation; bursts look like a compromised account or a spammer who just bought the domain.

If your domain is new, send mostly to people who expect your mail, keep daily volume low for the first few weeks, and ramp gradually. Our warm-up guide has a day-by-day schedule.

Step 4: Review content and links

Content filters matter less than authentication and reputation, but they still tip borderline messages. Look for these patterns:

• Link shorteners (bit.ly and similar) and links to domains that differ from your sending domain — both are common in phishing.
• A link domain or tracking domain that is itself on a blocklist; check every domain in the message, not just yours.
• Image-only emails or a single large image with little text.
• Attachments like .zip, .exe, .js or macro-enabled Office files, which many receivers quarantine outright.
• Mismatched display text and link targets — for example, text showing yourbank.com that links somewhere else.
• Heavy formatting copied from Word, ALL-CAPS subject lines and excessive punctuation. These rarely cause spam alone, but they add up.

Step 5: Clean your list and watch engagement

Mailbox providers now weigh how recipients react more heavily than almost anything you put in the message. Sending to addresses that bounce, to people who never open, or to people who did not ask for your mail drives complaint rates up — and Gmail expects bulk senders to stay below a 0.3% spam-complaint rate.

Remove hard-bounced addresses immediately, stop mailing contacts who have not engaged in months, never send to purchased or scraped lists, and make unsubscribing easy. A single bad import of old contacts can undo months of good reputation.

Step 6: Check blocklists and shared-IP reputation

If you send through a shared mail server, its IP addresses carry the combined reputation of every customer on them. Look up the sending IP (found in the first Received: header added by your provider) on major blocklists such as Spamhaus, Barracuda and SpamCop. Also check your domain itself against domain-based lists like Spamhaus DBL and SURBL.

A listing on an IP you do not control is your provider’s job to resolve — send them the bounce or header. A listing on your own domain usually points to compromised forms, a hacked mailbox, or links in your mail that were abused elsewhere.

Step 7: Use the providers’ own dashboards and test tools

Google Postmaster Tools (postmaster.google.com) shows Gmail’s view of your domain: spam rate, authentication results and compliance with the sender requirements. It needs some volume before data appears, but it is the only first-hand view of how Gmail sees you. Microsoft’s SNDS does a similar job for IP addresses sending to Outlook.com.

For a quick one-off check, mail-tester-style services give you a throwaway address; send a real message to it and they score authentication, blocklists and content in one report. Use your normal email, not a blank test, or the result tells you little.

If you host mail with HavitoMail, the DNS wizard re-checks MX, SPF, DKIM and DMARC live, so you can rule authentication in or out in seconds before moving on to reputation.