Why are my emails going to spam?

The usual reason: your domain can't prove the mail is yours

When you send an email, the receiving server checks whether your domain says the sending service is allowed to send for you. Three DNS records answer that: SPF, DKIM and DMARC. If they are missing or wrong, Gmail, Outlook and Yahoo treat your mail as suspicious. Since 2024, Google and Yahoo require them from anyone who sends a lot of mail. Start by running our free email check to see which ones you have.

Step 1: List everything that sends mail as you

Your mailbox provider (Google Workspace, Microsoft 365 or your web host), your newsletter tool, your online shop, your booking or invoicing software: every one of them needs to be allowed. Missing one is the most common SPF mistake.

Step 2: Publish one SPF record

SPF is a TXT record on your domain that lists the allowed senders. You may have only one; two SPF records break it. Examples:

• Google Workspace only: v=spf1 include:_spf.google.com ~all
• Microsoft 365 only: v=spf1 include:spf.protection.outlook.com ~all
• Google Workspace plus a newsletter service: v=spf1 include:_spf.google.com include:(the address your service gives you) ~all

Keep it to 10 DNS lookups or fewer (each include counts, and some count more than once), or receiving servers stop reading it.

Step 3: Turn on DKIM

DKIM signs each message so the receiver can tell it wasn't changed. You switch it on in your provider's admin panel, which gives you a TXT record to publish under a name like google._domainkey or selector1._domainkey. In Google Workspace it is under Gmail's Authenticate email setting; in Microsoft 365 it is in the Defender portal's DKIM settings. Do it for every service in Step 1 that supports it.

Step 4: Add DMARC, carefully

DMARC tells receivers what to do when SPF and DKIM fail, and sends you reports. Start gently, with a TXT record named _dmarc:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Read the reports for two to four weeks to find senders you forgot, fix them, then move to p=quarantine and later p=reject. Jumping straight to reject is how businesses block their own invoices.

Step 5: Check, then wait

Run the email check again, then send test messages to a Gmail and an Outlook address and open "Show original" to confirm SPF, DKIM and DMARC all say PASS. DNS changes can take up to a day to spread.

If it still goes to spam

Then it is likely the content or the list, not the records: links to sites with a bad reputation, all-image emails, buying lists, or many people marking you as spam. Google asks bulk senders to keep the spam rate under 0.3% and to offer one-click unsubscribe.

Should you do this yourself?

If you have one mailbox provider and nothing else sends for you, Steps 2 to 4 take an afternoon. With several services, an old domain or mail already being blocked, it gets fiddly fast, and a wrong record can stop mail entirely.

Written by Geek Patch. Last reviewed 2026-11-06.