Why Are My Emails Going to Spam? A Six-Step Diagnosis

Emails go to spam for one of six reasons, and it pays to check them in this order: authentication (SPF, DKIM, DMARC), blocklists, bounces and list quality, sending patterns, content and links, and finally engagement. The first two are yes-or-no checks that take a minute each. The last four are about reputation, which builds up over weeks and takes longer to repair.

Most articles on this topic list eight or ten causes in no particular order and leave you to guess. This one is a decision tree. Each step tells you what to look at, which free tool answers the question, what a bad result looks like and what to do about it. If the problem only shows up at one provider, the provider-specific guides go deeper: why emails go to spam in Gmail and why emails land in Outlook's Junk folder.

Before you start: is it spam placement or a bounce?

If your sending tool logged a bounce, the message never reached a spam folder. The receiving server refused it, and the error code usually names the reason. That is a different problem.

Look in your platform's activity log for the recipient. A 550 5.1.1 means the address doesn't exist (what 550 5.1.1 means). A 550 5.7.1 or 554 5.7.1 means the server refused you, usually for reputation or policy reasons (550 5.7.1 explained). Microsoft rejects mail from high-volume domains that fail its authentication rules with 550 5.7.515, covered in Microsoft's bulk sender requirements.

Then get one message that actually landed in spam, ideally in a personal Gmail or Outlook.com account you control, sent through your real sending path. Testing from your laptop's mail client when campaigns go out through a platform tests the wrong system. One test is a sample of one, so use it to diagnose, not to declare victory.

The diagnostic tree at a glance

Step	Question	Free tool	If it fails
1. Authentication	Do SPF, DKIM and DMARC pass and align with the From domain?	Email header analyzer, SPF checker, DKIM checker, DMARC checker	Fix DNS before anything else
2. Blocklists	Is the domain listed on Spamhaus DBL, SURBL or SpamCop?	Blacklist check	Fix the cause, then request delisting
3. Bounces and list quality	Are dead or risky addresses on the list?	List health check, single verifier, full list verification	Remove invalid addresses before the next send
4. Sending patterns	Did volume jump, or does mail go out in bursts?	Your sending tool's daily volume report	Smooth volume, warm up new domains
5. Content and links	Do links, tracking domains or formatting look suspicious?	Header analyzer for filter verdicts	Fix links and markup; skip word lists
6. Engagement	Do recipients ignore, delete or report your mail?	Google Postmaster Tools, Microsoft SNDS	Narrow the audience, honour unsubscribes

For a one-page view of steps 1 and 2 together, the deliverability test audits MX, SPF, DKIM, DMARC and the major blocklists for a domain in one pass.

Step 1: Authentication

Start here because it is binary and because the big providers now require it. Either your mail proves it comes from your domain or it does not.

Open the spam-foldered message and view the raw header (Show original in Gmail, View message source in Outlook). Paste it into the email header analyzer. You are looking for three things in the Authentication-Results line: spf=pass, dkim=pass and dmarc=pass. DMARC passing matters most, because it only passes when SPF or DKIM passes and the domain they checked matches the domain in your visible From address. That matching is called alignment, and it is the most common thing people miss. A platform can sign with its own DKIM domain and pass DKIM while DMARC still fails for you.

The providers' rules are explicit. Google's email sender guidelines require every sender to "Set up SPF or DKIM email authentication for your sending domains", and senders of more than 5,000 messages a day to Gmail must have both, plus DMARC, with the From domain "aligned with either the SPF domain or the DKIM domain." Yahoo's sender best practices say bulk senders must "Implement both SPF & DKIM" and "Publish a valid DMARC policy with at least p=none - DMARC must pass." Microsoft applies the same pattern to Outlook.com for domains sending over 5,000 a day.

If the header shows a failure, check the records themselves:

• SPF fails: run the SPF checker. Common causes are a sending service missing from the record, two SPF records on one domain, or more than ten DNS lookups. See common SPF mistakes.
• DKIM fails or is missing: run the DKIM checker with the selector from the header's DKIM-Signature line (s=). Missing DKIM usually means the sending tool was never set up to sign as your domain.
• DMARC missing or failing: run the DMARC checker. If there is no record, start with p=none and a reporting address; our DMARC record examples show safe starting points.

The background on how the three fit together is in SPF, DKIM and DMARC explained. If all three pass and align, authentication is not your problem. Move on.

Step 2: Blocklists

A listing on a major blocklist can explain a sudden collapse in delivery almost on its own, so rule it out next. It takes seconds.

Run your sending domain through the blacklist check, which queries Spamhaus DBL, SURBL and SpamCop. Also check any domain that appears in your links, including your link-tracking domain, since domain blocklists are applied to URLs in the body as well as to the sender.

One caution when reading any blocklist result: some lists refuse queries from public DNS resolvers and return an error code instead of an answer. A checker that treats every response as a listing will tell clean domains they are blocked. Ours reports a query it could not perform as unchecked. The detail is in Spamhaus lists explained.

If you are listed, do not request removal straight away. Listings are a symptom of something earlier in this tree: a spike in bounces, complaints or spam-trap hits. Fix that first, then follow the list's own process, which we walk through in how to get off a blacklist.

Step 3: Bounces and list quality

Sending to addresses that don't exist is one of the clearest signals that a list was bought, scraped or left to rot, and filters treat it that way. It is also the step most within your control.

Check your recent bounce rate in your sending tool. Our bounce rate benchmarks compare published figures and explain why they disagree, but the practical rule is simpler: if every send produces a noticeable batch of hard bounces, list quality is contributing to your spam placement. The guide to calculating bounce rate shows how to measure it consistently.

Google's guidelines are direct about the hygiene expected: "Automatically unsubscribe recipients who have multiple bounced messages", "Don't purchase email addresses from other companies" and "Confirm each recipient's email address before subscribing them." Old lists also collect recycled spam traps, which is how many blocklist listings start; see how spam traps get onto your list.

What to do:

1. Run the list through the free email list health check to see how much of it is dead domains, typos, disposable and role addresses, and duplicates. To find the mailboxes that no longer exist, verify the full list.
2. Verify the remaining addresses at mailbox level before the next send. The single email verifier does one address at a time if you want to spot-check.
3. Treat catch-all results with care: the server accepts every address, so a mailbox check cannot confirm the individual exists. Send to them in small batches rather than all at once.
4. Make sure hard bounces are suppressed automatically, and that soft bounces are retried and removed only when they repeat. Our hard vs soft bounce guide covers the codes.

Step 4: Sending patterns

Filters judge you partly on how you send, not just what you send. A domain that sent 50 emails a day last week and 5,000 today looks like a compromised account or a spammer, whatever the content.

Google's guidance on volume is plain: "Send email at a consistent rate. Avoid sending email in bursts", and "Avoid introducing sudden volume spikes if you do not have a history of sending large volumes." It also says that if messages are bouncing or deferred, you should reduce volume until the error rate drops before raising it again.

Things to check in your sending tool's reports:

• A new domain or inbox sending at full volume from day one. New senders have no reputation, and filters default to caution. Follow a ramp such as the one in our email warm-up schedule.
• Volume spikes. A product launch or a newly imported list can multiply daily volume overnight. Spread large sends over several days.
• Bursts at one minute. Scheduling 10,000 messages for exactly 9:00 creates a spike even if the daily total is normal. Most tools let you throttle sends per hour.
• Too much per inbox for cold email. Workspace and Microsoft 365 limits are ceilings, not safe targets; see cold emails per day per inbox.
• Shared IPs. If your provider puts you on a shared IP, other senders' behaviour affects you. That is a provider question rather than a DNS one.

If you have recently changed any of these, that change is your prime suspect.

Step 5: Content and links

Content comes fifth for a reason: it is rarely the root cause, but it can tip a borderline sender into spam. Single "spam words" matter much less than people think, as we show in do spam trigger words still matter.

What does count, according to Google's own guidelines:

• Links that hide where they go. "Web links in the message body should be visible and easy to understand." Link text that says one domain and points to another looks like phishing.
• Hidden content. "Don't use HTML and CSS to hide content in your messages." Invisible text blocks, often left over from templates, can get mail filed as spam.
• Mixed message types. "Don't mix different types of content in the same message", for example promotions inside a receipt.

Other content-level issues worth checking:

• Shared or poor-reputation link domains. Every tracked link points to a redirect domain. If it is shared with other senders, you inherit their reputation; a custom tracking domain avoids that.
• Open-tracking pixels in cold email. They add a remote image and often a shared domain to plain one-to-one mail; see does open tracking hurt deliverability.
• Image-only messages and broken HTML. A single large image with no text gives filters nothing to read but the image.
• Missing or hard unsubscribe. For marketing mail, Google and Yahoo require one-click unsubscribe for bulk senders, and Yahoo says to "Honor unsubscribes within 2 days." People who cannot unsubscribe easily press the spam button instead, which feeds Step 6. Setup is covered in one-click unsubscribe.

The header analyzer shows any spam filter verdict headers the receiving server added, which sometimes name a content rule directly.

Step 6: Engagement and complaints

If steps 1 to 5 are clean and you still land in spam, the recipients are telling the filter they don't want the mail. This is the hardest cause to fix because it is about who you send to and what they think of it.

Google asks senders to "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Yahoo's limit is "Keep your spam rate below 0.3%." Those percentages are of delivered mail, so 0.3% is three complaints per thousand messages. A few annoyed recipients on a small send can push you over.

Where to look:

• Google Postmaster Tools shows the spam rate for your domain at Gmail once you send enough volume. Our Postmaster Tools guide explains each dashboard, including why a very low reported rate can still be bad news.
• Microsoft SNDS and JMRP cover Outlook.com, but only if you control the sending IP. See the Outlook Junk guide.
• Your own data: clicks, replies and unsubscribe rates by segment. Opens are unreliable since Apple Mail Privacy Protection, so don't judge engagement on them.

What helps:

• Send only to people who opted in or, for cold email, who have a specific reason to hear from you.
• Stop mailing people who have not clicked or replied in months. A sunset policy makes that a rule rather than a judgement call each time.
• Make unsubscribing easier than complaining.
• If complaints have already damaged your reputation, the recovery is gradual; recovering a damaged sender reputation sets out a 30-day plan.

A worked example

Suppose jane@acme-demo.com starts a cold campaign from a new domain and finds replies have dried up and test messages land in spam.

1. Authentication: the header shows spf=pass, dkim=pass with d=sendingtool-demo.com, and dmarc=fail. DKIM passed for the tool's domain, not hers, so it doesn't align. She enables custom DKIM in the tool and publishes the CNAME. DMARC now passes.
2. Blocklists: the domain is not listed.
3. List quality: her first send bounced at 9%. The list was an old export. Verifying it removes a large share of dead addresses before the next step.
4. Sending pattern: the new domain went from zero to 400 a day in the first week. She drops to a warm-up ramp.
5. Content: links use the tool's shared tracking domain. She sets up a custom one.
6. Engagement: she checks again after two weeks of smaller, cleaner sends.

Several causes were present at once, which is typical. Fixing them in order meant the cheap, certain fixes were done before the slow ones.

The short version

When mail goes to spam, work down the list rather than guessing: confirm authentication passes and aligns, rule out blocklists, clean the list, smooth the sending pattern, check links and markup, and only then look at engagement. The first three checks are free and take minutes, and they explain a large share of cases. For the list-quality step, you can run a CSV through the free list health check for structural problems, then verify every mailbox with SimpleVerifier before you send again, and the deliverability checklist covers the remaining set-up checks in one place.