Why Are My Emails Going to Spam? A Troubleshooting Checklist

October 18, 2026

Someone tells you they never got your email. You check. It’s sitting in their spam folder, right next to a fake parcel notice and a “crypto opportunity.”

Annoying. And a little insulting.

The short answer: most emails go to spam because of missing or broken authentication (SPF, DKIM and DMARC), a poor sender reputation, or recipients marking them as spam. Website emails sent without proper SMTP, blocklisted IPs and old email lists are the next most common causes. The content of the email matters far less than most people think.

Spam filtering isn’t magic, and it’s rarely random. Most of the time the cause is something you can check yourself in under an hour. I’ve gone through this process more often than I’d like, for my own domains and for client sites, and the order of the checks below is the order I actually use. Start at the top. Stop when you find the problem.

Is your email in spam, or was it rejected?

This sounds pedantic, but it changes everything. “Going to spam” and “not arriving at all” are two different problems.

If the message shows up in the junk folder, the receiving server accepted it and then decided it didn’t trust it. If nothing shows up anywhere, check your own inbox for a bounce message (also called an NDR). Bounces contain an SMTP status code, and that code usually tells you exactly what went wrong. These are the ones you’ll see most often right now.

421-4.7.26 and 550-5.7.26 (Gmail)

Your message failed authentication. Gmail wants SPF or DKIM to pass for every sender, and bulk senders need both. The 421 version is a temporary deferral, the 550 version a permanent rejection. Either way, start with the SPF and DKIM checks below.

550 5.7.515 (Outlook.com, Hotmail, Live)

Your domain doesn’t meet Microsoft’s authentication requirements for high-volume senders: SPF, DKIM and a DMARC record that aligns with your From domain.

550 5.7.509 (Microsoft)

The message failed DMARC and your own DMARC policy says p=reject. Microsoft is just doing what you told it to.

Read the bounce carefully. It saves you a lot of guessing.

Is your SPF record set up correctly?

SPF is a DNS TXT record that lists which servers are allowed to send mail for your domain. If the server that sent your email isn’t on that list, the check fails.

The classic mistakes:

Two SPF records. You’re only allowed one per domain. Two records means SPF breaks, even if each one looks fine on its own. Merge them.
A forgotten sender. Your mailbox provider is in the record, but your newsletter tool, your CRM or your shop’s transactional email service isn’t.
Too many lookups. SPF allows a maximum of 10 DNS lookups (RFC 7208). Every include: counts, and so do the includes inside those includes. Go over the limit and the result is a permanent error, which most receivers treat as a fail.

A clean record looks something like this:

v=spf1 include:_spf.yourprovider.com include:mail.yournewsletter.com -all

One line. Every service that sends as you. Done.

Is DKIM signing your mail with your own domain?

DKIM adds a cryptographic signature to every message. The receiving server fetches your public key from DNS and checks that the message wasn’t altered and really came from you.

Here’s the part people miss: a lot of email services sign your mail by default, but with their domain, not yours. Technically DKIM passes. Practically, it doesn’t help you much, because the signature doesn’t belong to the domain in your From address.

Open the raw source of a message you sent and look for the DKIM-Signature header. The d= value should be your domain (or a subdomain of it). If it says d=someservice.net, go into that service’s settings and set up a custom DKIM key for your domain. It’s usually two or three CNAME records.

Do you have a DMARC record, and does it align?

DMARC ties SPF and DKIM to the address people actually see: the From header. It checks whether at least one of them passed and matched your From domain. That matching is called alignment, and it’s where a lot of setups quietly fall apart.

You can have SPF pass and DKIM pass and still fail DMARC. It happens all the time when a third-party tool sends on your behalf with its own envelope domain and its own DKIM key.

If you don’t have a DMARC record at all, start with this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

p=none doesn’t block anything. It just asks receivers to send you reports, so you can see who’s sending as your domain and whether it aligns. Once the reports look clean, move to p=quarantine and eventually p=reject.

For bulk senders this isn’t optional anymore. Gmail, Yahoo and Microsoft all expect a DMARC record of at least p=none, and they enforce it. If you want the bigger picture of how SPF, DKIM and DMARC fit together on a message’s way to the inbox, I wrote about that in how email travels from sender to inbox.

Does your sending server have valid reverse DNS?

If you use Google Workspace, Microsoft 365 or a proper email service, you can mostly skip this one. If you run your own mail server or send from a VPS, don’t.

The IP address that sends your mail needs a PTR record (reverse DNS) pointing to a hostname, and that hostname needs to resolve back to the same IP. Gmail requires this for every sender, regardless of volume. It also expects mail to arrive over TLS.

Your hosting provider sets the PTR record, not you. It’s usually a field in the control panel, sometimes a support ticket.

Is your domain or IP on a blocklist?

Blocklists (DNSBLs) are lists of IPs and domains that have been caught sending spam. Many receiving servers check them before they even look at your content.

Check your sending IP and domain against the big ones, especially Spamhaus. If you’re listed, each blocklist has its own delisting process. Most want you to fix the cause first, so find out why you got listed: a compromised account, an infected contact form, a shared IP with a bad neighbor.

Shared IPs are worth a second look. On cheap shared hosting, you’re sharing a reputation with everyone else on that server. You can do everything right and still get dragged down.

Why are my WordPress emails going to spam?

This one is so common it gets its own section.

Contact forms, WooCommerce order confirmations, password resets: by default WordPress sends them through PHP’s local mail() function. That mail leaves from your web server’s IP, which is almost never in your SPF record, and it’s almost never DKIM-signed with your domain. Sometimes the From address is even something like wordpress@server123.hostingcompany.com.

Receivers see that and, fairly enough, don’t trust it.

The fix is to send through authenticated SMTP or an email API instead, using a real mailbox or transactional service on your own domain. Then check the result with the same SPF, DKIM and DMARC steps above. The same applies to any other CMS, shop system or web app that sends mail on its own.

Why did my emails suddenly start going to spam?

If your emails were fine last month and aren’t now, something changed. Usually one of these:

A new domain. New domains have no reputation, and no reputation looks suspicious.
A sudden jump in volume. Going from 50 emails a week to 5,000 in a day is a red flag for any filter. Ramp up gradually.
A new tool that sends on your behalf and isn’t in SPF or set up for DKIM.
A DNS migration where someone forgot to copy the TXT and CNAME records.
A compromised mailbox or contact form that’s been sending spam in your name.

The DNS migration one is more common than anyone wants to admit.

Are recipients marking your emails as spam?

Authentication tells the receiver who you are. Complaints tell it whether people want your mail. And complaints matter a lot.

Google publishes concrete numbers here: keep the user-reported spam rate below 0.3%, and ideally below 0.1%. That’s one complaint per thousand messages. It’s not a lot of room.

If you send newsletters or marketing email, the usual fixes are boring but effective:

Make unsubscribing easy. If unsubscribing is hard, the spam button is the unsubscribe button.
Bulk senders (5,000+ messages a day to Gmail) need one-click unsubscribe via the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058). Most email platforms handle this for you, but check.
Only send to people who actually asked for it. Bought lists are a fast way to wreck a domain.
Send what you promised at signup, at the frequency you promised.

Can a bad email list hurt deliverability?

Yes. Quite a lot, actually.

Old lists collect junk. Addresses get abandoned, some get turned into spam traps, others start hard bouncing. Every bounce and every trap hit is a signal to receivers that you don’t look after your list.

Remove hard bounces immediately. Drop people who haven’t opened or clicked in a long time, or send them one re-engagement email and remove them if they don’t respond. Your list gets smaller. Your deliverability gets better. That’s the trade.

Can email content trigger spam filters?

It can, but notice how far down the list this is. People love to blame the word “free” or too many exclamation marks, but modern filters care much more about who you are than what you wrote.

That said, content can tip a borderline sender over the edge:

Emails that are just one big image with almost no text
Link shorteners, which spammers use to hide where links go
Links to domains with a bad reputation
A display name or subject line that doesn’t match who you are
Broken HTML from copy-pasting out of a word processor

Write like a person writing to a person. It works better for filters and for readers.

Why are my emails going to spam in Gmail?

Gmail is the strictest of the big providers, and since November 2025 it has been enforcing its sender rules much harder. Mail that doesn’t comply can now be deferred or rejected outright, not just filtered.

What Gmail looks at most:

Authentication. Every sender needs SPF or DKIM. If you send 5,000 or more messages a day to personal Gmail accounts, you need SPF and DKIM, plus a DMARC record that aligns with your From domain.
Spam complaints. Below 0.3%, ideally below 0.1%. Gmail doesn’t pass these complaints on to your email platform, so your newsletter tool’s stats won’t show them.
Infrastructure. Valid reverse DNS and TLS for every sender.
Unsubscribing. One-click unsubscribe for bulk marketing mail.

The only place to see how Gmail sees you is Google Postmaster Tools. Its compliance dashboard shows a pass or fail for each requirement, which makes it a pretty good starting point. Google’s own email sender guidelines list every requirement in detail.

Why are my emails going to junk in Outlook?

Outlook.com, Hotmail and Live run on Microsoft’s own filtering, and it behaves differently from Gmail. You can land in junk at Outlook and in the inbox at Gmail with the same message.

Since May 5, 2025, Microsoft requires domains that send more than 5,000 emails a day to its consumer addresses to pass SPF and DKIM and to publish a DMARC record (at least p=none) that aligns with SPF or DKIM, preferably both. Non-compliant mail gets junked or rejected with 550 5.7.515.

Unlike Google, Microsoft doesn’t publish a complaint threshold. For visibility, Microsoft offers SNDS (data on your sending IPs) and JMRP (a feedback loop for junk reports). Both are mainly useful if you send from your own IPs. The Outlook.com sender policies are worth a read too.

Business mailboxes on Microsoft 365 are a separate case: the receiving company’s admins control the filtering there, so a message can end up in quarantine even if you’ve done everything right.

How do I test whether my emails pass authentication?

The quickest test is free: send an email to a Gmail address you control, open it, and choose “Show original.” You’ll see SPF, DKIM and DMARC results at the top. For more detail, look for the Authentication-Results header in the raw source. Any desktop email client that lets you view raw headers works for this too.

For ongoing monitoring:

Google Postmaster Tools: your Gmail spam rate and compliance status.
Microsoft SNDS: data about your sending IPs at Outlook.com.
DMARC reports: the rua reports from your DMARC record show every server sending as your domain. Raw XML is painful to read, so use a report viewer.

Email spam troubleshooting checklist

Check for bounce messages and read the SMTP code.
Make sure you have exactly one SPF record, with every sending service, under 10 lookups.
Make sure DKIM signs with your own domain (d=yourdomain.com).
Publish a DMARC record and check that SPF or DKIM aligns with your From domain.
If you run your own server: valid reverse DNS and TLS.
Check your IP and domain against blocklists.
Stop sending website mail through PHP mail(). Use authenticated SMTP or an API.
Think about what changed recently: domain, volume, tools, DNS.
Keep spam complaints below 0.3% (better: below 0.1%) and make unsubscribing easy.
Clean your list. Remove bounces and long-term inactive contacts.
Only then: look at the content.

Nine times out of ten, the problem shows up somewhere in steps one to seven. It’s rarely exciting. It’s usually DNS.

Frequently asked questions

Why do my emails go to spam in Gmail but not in Outlook?

Every provider runs its own filters and weighs signals differently. Gmail relies heavily on authentication and user complaints, so a missing DKIM signature or a few spam reports from Gmail users can hurt you there without affecting Outlook. Check Google Postmaster Tools for Gmail-specific data.

Do I need SPF, DKIM and DMARC if I only send a few emails a day?

Gmail requires at least SPF or DKIM from every sender, regardless of volume. The stricter rules (both SPF and DKIM, DMARC, one-click unsubscribe) apply to bulk senders. Setting up all three anyway costs you a few DNS records and protects your domain from being spoofed.

How long does it take to fix a bad sender reputation?

Technical fixes like SPF or DKIM take effect as soon as DNS updates. Reputation takes longer. Expect days to weeks of consistent, low-complaint sending before things improve. Google’s spam rate is evaluated over time, not per day, so one good day won’t flip it.

Can certain words trigger spam filters?

Rarely on their own. Modern filters look mostly at authentication, sender reputation and recipient behavior. Content matters at the margins, like image-only emails, link shorteners or misleading subject lines, but fixing your DNS records and your list will do far more than avoiding the word “free.”

What is a good spam complaint rate?

Google’s hard limit is 0.3% of messages reported as spam. The recommended target is below 0.1%, which is one complaint per thousand emails. If you’re consistently above that, look at your signup process, your sending frequency and how easy it is to unsubscribe.