Why Your Emails Go to Spam (and How to Fix SPF, DKIM, DMARC)

Emails usually go to spam because the receiving server can't confirm they really came from your domain. Since February 2024, Gmail and Yahoo have required every sender to pass SPF or DKIM, and mail that fails can be sent to spam or rejected outright. Fix that first with three DNS records (SPF, DKIM and DMARC), then look at your domain's reputation and at what you send.

The short version:

1. Send a test to a Gmail address, choose "Show original" and note the SPF, DKIM and DMARC results.
2. Fix whatever fails: one SPF record, DKIM for every service that sends as your domain, and a DMARC record starting at p=none.
3. Check your domain on Spamhaus and keep your sending volume steady.
4. Keep messages plain: clear links, normal attachments, a From address on your own domain.

This guide covers everyday one-to-one mail such as quotes, invoices and replies. For contact forms and shop order emails, read why WordPress is not sending email; the fix there is different.

Why are my emails going to spam? Check Gmail's "Show original" first

The receiving server records exactly which checks your message passed, and you can read it in a minute.

Gmail on a computer: open the message, click More (three dots) next to Reply and choose Show original (Google's guide). The top of the new window summarises SPF, DKIM and DMARC as PASS or FAIL, and the Authentication-Results line shows the same verdicts (Google's authentication help). A simplified example:

Authentication-Results: mx.google.com;
   dkim=pass header.i=@yourbusiness.in header.s=zoho;
   spf=pass smtp.mailfrom=accounts@yourbusiness.in;
   dmarc=pass (p=NONE) header.from=yourbusiness.in

In the Gmail app on Android, tap View details, then View security details. A question mark next to the sender's name means the message wasn't authenticated.

Outlook emails going to junk: in Outlook.com, Outlook on the web and the new Outlook for Windows, select More actions, then View > View message details. In classic Outlook, open the message and go to File > Properties (Microsoft's guide). Paste the headers into Google's free Messageheader tool, which Google recommends, to read them easily.

SPF record example: one record, at most 10 lookups

SPF is a TXT record listing the servers allowed to send for your domain. Under RFC 7208 it checks the envelope sender (the bounce or Return-Path address), not the From address your customer sees. That is why SPF can pass while DMARC fails.

Google Workspace's SPF help gives this record; Zoho's uses include:zohomail.com. Copy the exact value your provider's console shows.

Name:  @  (your root domain)
Type:  TXT
Value: v=spf1 include:_spf.google.com ~all

Two senders, still one record:
v=spf1 include:_spf.google.com include:sending-service.example ~all

• Only one SPF record. Two v=spf1 records give a "permerror" under RFC 7208. It is the classic slip after switching provider: the new record is added and the old one never deleted.
• No more than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including those nested inside includes; ip4, ip6 and all don't. Over 10 is another permerror. Remove services you no longer use.
• ~all or -all. -all means "fail" for unlisted servers; ~all is a "softfail" that the RFC says receivers should not reject on alone. Google recommends ~all; Zoho's standard record uses -all. Use ~all until you are sure every sender is listed.

Google says SPF can take up to 48 hours to start working.

DKIM: why emails go to spam after a domain or provider change

DKIM signs every message. Your provider keeps a private key and you publish the public key under a selector, at selector._domainkey.yourbusiness.in (RFC 6376). Selectors let one domain hold several keys, one per provider. Zoho's DKIM help uses zoho as its example:

Name:  zoho._domainkey
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... (full key from your provider)

Some providers give CNAME records instead; add what the dashboard shows. Google requires keys of at least 1024 bits for mail to personal Gmail accounts and recommends 2048.

• New email provider: the old selector's key belongs to the old provider. Until you publish the new one (and switch signing on, where the provider asks you to), mail goes out unsigned or signed with the provider's own domain, and DMARC fails.
• New domain: it has no DKIM until you set it up, and no sending history (see reputation below).
• Extra senders: invoicing, CRM and booking tools that send "from" your address each need DKIM for your domain, usually under "domain authentication" in their settings.

Keep the old provider's record until it has stopped sending; different selectors don't conflict.

DMARC record example, and alignment explained simply

DMARC is a TXT record at _dmarc that tells receivers what to do with mail that fails and where to send reports. A message passes only if SPF or DKIM passes and the domain that passed matches the visible From domain. That match is alignment.

Example: your billing software sends "From: accounts@yourbusiness.in" but signs with its own domain. SPF and DKIM both pass, for the software company's domain, so DMARC fails. The fix is DKIM for your domain inside that software. Alignment is "relaxed" by default, so mail.yourbusiness.in still aligns with yourbusiness.in.

Name:  _dmarc
Type:  TXT

Stage 1 (monitor):     v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.in
Stage 2 (spam folder): v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourbusiness.in
Stage 3 (block):       v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourbusiness.in

• Start at p=none. Google advises waiting 48 hours after SPF and DKIM, then moving to quarantine or reject over time. Microsoft also says none, then quarantine, then reject.
• Read the rua reports. Receivers send XML reports showing who sent as your domain and whether it passed. Use a dedicated mailbox, as Google suggests, and a free report viewer.
• Enforce only when reports are clean, or p=reject will block your own invoicing tool.
• Keep one DMARC record. RFC 9989 (May 2026, replacing RFC 7489) says multiple records are all discarded. It also drops the pct tag older guides use, so move in whole steps.

Reverse DNS (PTR) and TLS for self-hosted mail servers

This applies only if you run your own mail server, such as Postfix on a VPS. Hosted providers handle it for their servers.

Google's sender guidelines require valid forward and reverse DNS: the sending IP's PTR record names a hostname whose A or AAAA record points back to the same IP. Yahoo wants PTR records that are "valid, meaningful, non-generic". Google also requires TLS.

203.0.113.25           PTR  mail.yourbusiness.in
mail.yourbusiness.in   A    203.0.113.25

The PTR is set by whoever controls the IP (your VPS or internet provider), not in your domain's DNS. Running your own server also means patching and blocklist monitoring; a hosted mailbox is usually less work.

Gmail sender requirements, Yahoo and Outlook rules

As of October 2026:

Sources: Google's guidelines and FAQ, Yahoo Sender Hub, and Microsoft's announcement of 2 April 2025, updated on 29 April to reject rather than junk.

• The every-sender rules apply to you. Google's rules cover mail to addresses ending in gmail.com or googlemail.com, and its FAQ says that from November 2025 Gmail is "ramping up its enforcement on non-compliant traffic".
• Bulk is counted per domain. Google counts subdomains with the main domain, and crossing 5,000 once makes you a bulk sender permanently.
• Outlook.com means hotmail.com, live.com and outlook.com addresses. Microsoft says Safe Senders won't bypass the rules, and that all senders benefit from SPF, DKIM and DMARC.

Business email going to spam despite passing checks: reputation

If all three checks pass and mail still lands in spam, the receiver doesn't trust the domain or IP yet.

• Blocklists: Spamhaus's free Reputation Checker looks up whether an IP or domain is listed (spamhaus.org). With a hosted provider, check your domain; with your own server, its IP too. A listing usually has a cause, such as a hacked mailbox or an abused website form. Fix that before asking for removal.
• New-domain warm-up: Google says to start with low volume to engaged recipients, increase slowly and never suddenly double your volume. For a new domain, send normal replies and quotes for the first few weeks, not a Diwali offer to 3,000 imported contacts.
• Sudden volume: an unplanned spike is often a hacked mailbox, so change its password. HostEthical Mail limits each mailbox to 100 emails an hour and doesn't allow bulk mail; newsletters belong on a newsletter service.
• Postmaster Tools: Google's free Postmaster Tools verifies your domain with a TXT or CNAME record (setup) and shows compliance status, spam rate, authentication and delivery errors (dashboards). It covers only mail to personal Gmail accounts, and data can be missing on low-volume days, so small senders may see empty charts.

Content and habits that send good mail to spam or junk

• Clear links. Google says links should be "visible and easy to understand". Link to your own site rather than a public URL shortener, whose domain is shared with spammers too.
• Normal attachments. Gmail blocks file types such as .exe, .bat and .js, and password-protected archives. A PDF invoice is fine.
• Real text. One large image with almost no text looks like spam. Write the message as text.
• No tricks. Google asks senders not to hide content with HTML or CSS, not to use misleading display names, to use "Re:" only on real replies, and not to put promotions inside receipts.
• Your own domain in From. Never put a Gmail address in the From line of mail sent through another server; Google treats that as impersonation. Microsoft asks that the From or Reply-To address can receive replies.
• Forwarding. Auto-forwarded mail fails SPF at the final inbox, because the forwarding server isn't in the sender's record. Google doesn't require DMARC alignment for forwarded mail, and Yahoo and Microsoft ask forwarders to use ARC. If you began forwarding after Gmail stopped fetching other accounts, adding the mailbox to the Gmail app over IMAP avoids forwarding.

SPF, DKIM and DMARC setup at GoDaddy, Hostinger or Cloudflare

Records only count at the DNS host your nameservers point to; a GoDaddy domain using Cloudflare nameservers is edited at Cloudflare. See DNS records explained.

• GoDaddy: Domain Portfolio, open the domain, choose DNS and add a record, with @ for the root. GoDaddy appends the domain (Zoho's DKIM guide notes this), so enter just _dmarc or zoho._domainkey.
• Hostinger: hPanel, Domains, then DNS (Hostinger's guide). Edits only take effect while the domain uses Hostinger's nameservers.
• Cloudflare: MX and TXT records are always DNS only, but the hostname your MX points to "must also resolve to a DNS-only target" (Cloudflare). If that is mail.yourbusiness.in, set its A record to DNS only.
• HostEthical: with HostEthical Mail on our nameservers the records are added automatically; elsewhere, the dashboard shows the exact records to copy.

Allow up to 48 hours, then send another test and check "Show original" again.

Checklist: how to stop emails going to spam

Choosing a provider? See how to create a business email on your own domain and business email prices in India. Google Workspace or Zoho fit better if you need shared calendars or an office suite. For plain, reliable mailboxes, HostEthical Mail costs ₹79 a month, or about ₹65.83 a month when billed yearly, and every HostEthical hosting plan includes at least one free 1 GB mailbox.

Frequently asked questions

Why are my emails going to spam in Gmail?

Most often because the message fails SPF, DKIM or DMARC for your domain, so Gmail cannot confirm it came from you. Since February 2024 Gmail has required every sender to pass SPF or DKIM. Open the message in Gmail on a computer, choose Show original and see which result says FAIL. If all three pass, look at your domain's reputation, sudden jumps in sending volume, and content such as shortened links.

Why are my emails going to junk in Outlook?

Outlook sends mail to junk when authentication fails or the sender's reputation is poor. Open the message, choose More actions, View, View message details, and check the SPF, DKIM and DMARC results, then fix any failure. Since 5 May 2025, Outlook.com rejects mail from domains sending over 5,000 messages a day without passing SPF, DKIM and an aligned DMARC record, and Safe Senders does not bypass this.

What is a good DMARC record example for a small business?

Start with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.in as a TXT record named _dmarc. It does not change delivery, but receivers send you reports on who is sending as your domain. Once every legitimate service passes SPF or DKIM with your own domain, move to p=quarantine and later p=reject. Keep only one DMARC record, because the current standard says multiple records are all discarded.

Why are my emails going to spam after changing domain or email provider?

Usually because DKIM and SPF were not set up for the new provider or domain. The new provider signs mail with its own selector, so you must publish its DKIM record and add it to your single SPF record. A brand-new domain also has no sending history, so start with normal one-to-one mail and increase volume slowly, as Google advises. Keep the old provider's records until it stops sending.