Why your emails land in spam: the technical checklist
When legitimate email lands in spam the cause is usually technical. Twelve checks on authentication, domain reputation, sending setup and content, in order.
The short answer
Receiving mail servers make a fast decision about every message using three inputs: can the sender be verified, does this domain and address have a trustworthy history, and does the message look like mail that people mark as spam. Legitimate business email lands in spam when one of the three is weak, and in our experience the first one is where to look first.
Work through the checks in order. Stop when you find the problem, but finish the first four regardless.
Authentication
- SPF exists and includes every sender. Your mail provider, newsletter tool, CRM, invoicing, helpdesk, website forms. Under the lookup limit. A missing sender fails SPF.
- DKIM is on for every sender, aligned to your domain. Each tool signs with a key published under your domain, not the tool’s own domain.
- DMARC record exists, at least at none with reporting, so receivers see that you take authentication seriously and you see what fails.
- The from address matches the authenticated domain. Sending “from” your domain through a service that authenticates as its own domain fails alignment and looks like spoofing.
Reputation
- Sending address history. An address that has never received a reply, or that sends only bulk, is treated cautiously. Use real addresses that people answer, and reply from them.
- Domain age and behaviour. New domains start with no trust. Send gradually and authenticate fully from the first message.
- Shared sending infrastructure. Website forms and cheap hosting often send through servers shared with unknown parties. If a neighbour spams, you inherit the reputation. Send through a reputable, authenticated service instead.
- Blocklists. Check whether your domain or your sending servers appear on common blocklists. A previous owner of an address range or a compromised account can put you there.
Content and setup
- A plain-text version alongside the HTML, and HTML that is mostly text, not one large image.
- Links that match their text and point to your own domain, not shorteners or tracking domains with poor reputation.
- Subject and sender that are honest. No misleading urgency, no “Re:” on a first contact, a sender name that matches the address.
- List hygiene for bulk mail. Unsubscribe that works in one click, bounces removed, no purchased lists. Complaints from a few recipients hurt every future message.
| Symptom | Most likely check |
|---|---|
| Everything to one large provider goes to spam | 1 to 4, then 5 |
| Website form emails vanish or go to spam | 4 and 7 |
| Newsletter fine, personal email in spam | 5 and 9 to 11 |
| Suddenly worse this month | 8, and DMARC reports for a compromised account |
| New domain, poor delivery everywhere | 1 to 3, then 6 |
What this means for you
Run the first four checks today; they take an hour and fix most cases. If those pass, look at where the mail is sent from and how the address behaves. Only then look at content. And keep the DMARC reports flowing, because they show the next problem before your customers do.
Frequently asked questions
Our emails are fine to most people but land in spam at one big provider. Why?
Large providers apply their own reputation and authentication rules more strictly. A missing DMARC record, an unaligned DKIM signature or a sending address that has never been replied to by their users will trip them first. The checklist below is what they look at; the first four items are usually the cause.
Does the wording of the email matter?
Less than people think, and only after the technical checks pass. A message that fails authentication lands in spam regardless of wording. Once the setup is right, content matters mainly when it resembles bulk mail: image-only messages, many links, misleading subject lines, no plain-text version.
We just started using a new domain. Is that a problem?
New domains have no reputation, and large receivers treat unknown senders cautiously. Authenticate fully from day one, send gradually, and make sure early recipients are people who will open and reply. Reputation builds from behaviour; it cannot be configured.
How do we find out where we stand?
Send a test message to a mailbox at each major provider and to a deliverability testing tool, check the authentication results in the message headers, and read your DMARC reports. Together they show whether the problem is authentication, reputation or content.
Sources
- DMARC.org: Overview (accessed 2026-09-11)
- Cloudflare Learning Center: DMARC, DKIM and SPF (accessed 2026-09-11)