Why are my emails going to spam? How to fix it

Why emails go to spam: how filters decide#

No mailbox provider publishes its spam filter, but the big three publish what they expect of senders, and those documents describe the inputs. Gmail sorts mail with machine learning using signals that “include (but aren’t limited to) who the email comes from, what type of content is in the message and how Gmail users have interacted with similar content.”^[1] Its sender guidelines add that messages not authenticated with SPF or DKIM “might be marked as spam or rejected”, and that “if messages from your domain are frequently reported as spam, future messages from you are more likely to be marked as spam.”^[2]

Put together, a filter weighs four things: whether the message provably comes from the domain it claims (authentication), what the sending domain and IP have earned so far (reputation), how recipients react to your mail (feedback), and whether the message is well formed and honest about what it is. The first is a switch you set once. The other three are a running score, and the score is the reason a campaign that sailed through in spring can land in spam in autumn with nothing in the template changed.

Recipients’ reactions are the part you cannot configure, and they compound. As people report more spam, Gmail says it “identifies similar emails as spam more efficiently”, and a sender who keeps mailing someone after they unsubscribed goes straight to that person’s Spam.^[3] That is why most of the fixes below are about who you mail and how easily they can leave, not about the words in the email.

First, work out which problem you have#

“Going to spam” is three different failures, and each has a different fix. Before you change anything, find out which one you are looking at:

For the second case, open a copy of the message that landed in spam and read its Authentication-Results header, which the receiver adds to say whether SPF, DKIM and DMARC passed. Gmail also shows a warning at the top of each message in Spam explaining why it was put there.^[3] If authentication failed, fix that first: nothing else on this page matters until it passes.

Authentication-Results: mx.google.com;
       dkim=pass header.i=@example.com header.s=rasket;
       spf=pass smtp.mailfrom=send.example.com;
       dmarc=pass (p=NONE) header.from=example.com

Eight reasons your emails are going to spam#

Roughly in the order worth checking them. The first four account for most of what the providers’ own documents describe; the rest are quieter but just as fatal.

1. Authentication is missing, failing or misaligned#

Every sender to Gmail needs SPF or DKIM; anyone sending about 5,000 a day needs both, plus a DMARC record and a From domain aligned with the SPF or DKIM domain.^[2] Yahoo sets the same line,^[4] and Outlook.com rejects mail from high-volume domains that fail it with 550 5.7.515.^[5] Common failures that pass a quick glance:

• SPF over its lookup limit. Each include, a, mx, ptr and exists costs a DNS lookup, and past 10 the check returns permerror — a fail.^[6] Every tool you ever connected to your domain adds one.
• DKIM that passes for the wrong domain. A signature from your provider’s domain rather than yours passes DKIM but not DMARC, because DMARC needs the authenticated domain to match the From domain.^[7]
• Forwarding. A forwarded message arrives from the forwarder’s servers, so SPF fails, and a list that edits the message breaks DKIM. ARC exists to carry the original results across the hop,^[8] and Google points forwarders to its own forwarding guidance.^[2]

2. Too many people press “Report spam”#

The single most damaging number. Gmail asks every sender to keep the spam rate in Postmaster Tools below 0.3%, and bulk senders below 0.1%.^[2] Google’s FAQ says the impact is graduated: rates above 0.1% already hurt inbox delivery, and 0.3% or higher hurts more.^[10] Yahoo’s line for bulk senders is also 0.3%.^[4]

Complaints come from surprise: people who do not remember signing up, mail more frequent than they agreed to, or an unsubscribe link they could not find. Double opt-in and setting expectations at signup are the cheapest fixes; both are on Yahoo’s list of recommendations.^[4]

3. The list has bought, old or trapped addresses#

Google tells senders plainly: “Don’t purchase email addresses from other companies,” and do not mail people who did not sign up, because they “might mark your messages as spam, and future messages to these recipients will be marked as spam.”^[2] Old lists carry a second risk: addresses that stopped working, bounce, and in some cases are later turned back on as spam traps. Spamhaus describes traps built from typo domains, dead addresses and expired domains, and asks senders to “view spamtraps as proof of a data collection or hygiene issue” rather than hunting for the trap itself.^[11]

The fix is at the source: confirm addresses at signup, stop mailing hard bounces immediately, and consider unsubscribing people who never open — Google suggests it in as many words.^[2]

4. Leaving is harder than complaining#

If unsubscribing takes a login and four clicks, the spam button is the easier exit — and it is the one that counts against you. Bulk senders to Gmail must support one-click unsubscribe (the List-Unsubscribe and List-Unsubscribe-Post headers of RFC 8058) on marketing mail, show a visible unsubscribe link, and honour requests within 48 hours.^[10][12] The full rule set is in the bulk sender requirements guide.

5. Marketing and transactional mail share a reputation#

Reputation attaches to domains and IPs. Google asks senders to give each category of mail its own From address and not to mix content — “don’t include promotions in sales receipt messages” — and warns that on a shared IP “the activity of any senders using a shared IP address affects the reputation of all senders”.^[2] Yahoo goes further: don’t send bulk mail “from the same IPs you use to send user mail, transactional mail, alerts”, and segregate by IP or DKIM domain.^[4] A newsletter that draws complaints should not be able to drag your password resets into spam with it; see transactional vs marketing email.

6. Volume jumped, or the domain is new#

A new domain has no reputation, and a sudden spike looks like a compromised account. Google’s guidance is to start with a low volume to engaged users, send at a consistent rate rather than in bursts, and avoid spikes: “immediately doubling previously sent volumes suddenly could result in rate limiting or reputation drops.”^[2] The same applies after a change of format or infrastructure — ramp the changed traffic separately. That process is warming up.

7. The infrastructure is not what receivers expect#

Gmail requires every sender to have valid forward and reverse DNS (a PTR record) on its sending IPs, to use TLS, and to format messages to RFC 5322; Yahoo requires RFC 5321 and 5322 compliance and valid reverse DNS too.^[2][4] If you send through an email provider, this part is theirs; if you run your own mail server, check each one. RFC 5322 is also why a From header should carry exactly one address and a valid Message-ID.^[13]

8. The message misleads, or hides something#

Content matters less than folklore says, but deception is explicitly penalised. Google’s guidelines ask for display names that identify the sender and nothing else, subject lines that do not start with “Re:” or “Fwd:” unless the message is one, no HTML or CSS used to hide content, and links whose destination is obvious.^[2] Those are the content rules a provider has actually written down. Lists of forbidden words are not among them.

How much email goes to spam: what was measured#

Mailbox providers do not publish spam-folder rates. The best public figures come from seed-list testing firms, which send test mail to accounts they control and record where it lands. They are useful for the trend, less so for your own number.

Two details from the same report matter more than the headline. Over 2024, spam placement almost doubled, from 4.5% in the first quarter to 8.6% in the fourth, while the missing rate fell. As the report reads it, mailbox providers rejected fewer messages but became more likely to put the ones they accepted in spam.^[14] And the providers differ: Gmail placed 87.2% in the inbox and 6.8% in spam, Microsoft 75.6% and 14.6%.^[14]

How to fix emails going to spam, step by step#

Work through these in order. The first three stop the failures that providers enforce with rejections; the rest rebuild the reputation that decides the spam folder.

1. 1

   Find out what is actually happening

   Tell a rejection (a 4.7.x or 5.7.x bounce) from spam-folder placement and from the Promotions tab. Read the bounce text, and the Authentication-Results header on a message that landed in spam, before changing anything.

2. 2

   Make SPF, DKIM and DMARC pass, aligned

   Publish SPF within its 10-lookup limit, sign with DKIM on your own domain, publish a DMARC record (p=none is accepted), and make sure the From domain matches the SPF or DKIM domain.

3. 3

   Check the sending infrastructure

   Sending IPs need forward and reverse DNS (PTR) records, mail must go over TLS, and messages must follow RFC 5322, with one From address and a valid Message-ID. An email provider handles most of this; check it if you run your own servers.

4. 4

   Clean the list at the source

   Stop using bought or scraped addresses, confirm new signups, suppress hard bounces and complaints at once, and stop mailing people who have not opened in months.

5. 5

   Make leaving easier than complaining

   Add one-click unsubscribe headers (RFC 8058) and a visible link to marketing mail, and honour every request within 48 hours.

6. 6

   Separate marketing from transactional mail

   Give receipts, alerts and promotions their own From addresses, ideally with marketing on a subdomain, and never put offers inside a receipt.

7. 7

   Rebuild slowly and watch the spam rate

   Send to your most engaged readers first, grow volume gradually without sudden spikes, and keep the spam rate in Postmaster Tools below 0.1%.

To read your standing at Gmail, verify your domain in Postmaster Tools. Its spam rate is the share of mail delivered to the inbox that recipients then marked as spam, for DKIM-authenticated mail — so a rate that looks suspiciously low can mean Gmail is already sending much of your mail to spam, where nobody can report it.^[15] For Outlook.com, Microsoft’s Smart Network Data Services shows data for the IPs you control, with its junk-mail reporting programme alongside.^[16]

Rasket takes several of these off your list. Each verified domain gets a 2048-bit DKIM key and a return-path subdomain that makes SPF pass for your own domain, and the dashboard builds a DMARC record to start at p=none (see verified domains). Hard bounces, complaints and unsubscribes are written to an account-wide suppression list and checked before every send, and Campaigns carry the RFC 8058 one-click headers with a hosted preference page.

Recovering after your emails landed in spam#

Reputation recovers the way it was lost: through the mail you send next. There is no form that resets it. What helps:

1. Slow down when receivers push back. Google’s advice when messages bounce or are deferred is to cut volume until the error rate falls, then increase slowly again, and to wait at least 10 minutes after a 4.7.28 rate-limit error.^[2]
2. Mail only your most engaged readers for a while. Recent openers and clickers are the least likely to complain, and each good send is evidence in your favour.
3. Fix the cause before the volume returns. A list-source problem comes back with the list; a sunset policy for people who stopped reading is the long-term fix, and Microsoft suggests cleaning lists monthly or quarterly.^[17]
4. Know when you can ask for help. Gmail offers delivery mitigation only to bulk senders who meet every guideline, and only once the spam rate has stayed below 0.3% for seven consecutive days.^[10]

Why emails go to spam in Outlook and Yahoo#

The same principles apply, with differences in the details. Outlook.com requires domains sending more than 5,000 messages a day to pass SPF and DKIM and publish DMARC at least p=none aligned with one of them; since 5 May 2025 non-compliant mail has been rejected rather than sent to Junk.^[17] Microsoft also recommends, without requiring, a working reply address, a functional unsubscribe link, regular list hygiene and accurate subject lines.^[17]

Yahoo’s requirements match Gmail’s closely, with a 0.3% spam-rate line measured on mail delivered to the inbox, and a Complaint Feedback Loop that sends you a copy of each spam report for DKIM-signed mail, so you can remove complainers quickly.^[4] The measured gap in the previous section — more spam placement at Microsoft than at Gmail — is a reason to test Outlook addresses separately rather than assume a clean Gmail result carries over.^[14]

Myths about why emails go to spam#

• Unproven “Certain words send you to spam.” Litmus calls spam trigger words an email deliverability myth: filters look at IPs and domains, authentication and engagement.^[18] Deceptive formatting is penalised; the word “free” is not.
• Documented by Google “Passing SPF, DKIM and DMARC guarantees the inbox.” False. Google calls failing DMARC “one of several factors”, and authenticated mail is only “less likely” to be marked as spam.^[10][2]
• Documented by Google “Small senders don’t need to worry.” False. Gmail’s baseline — SPF or DKIM, reverse DNS, TLS, RFC 5322 and a spam rate under 0.3% — applies to every sender, whatever the volume.^[2]
• Documented by Google “A near-zero spam rate in Postmaster Tools means all is well.” Not necessarily. The rate counts reports on mail delivered to the inbox, so it can look low precisely because Gmail is already filtering your mail.^[15]
• Measured in research “If the server accepted it, it reached the inbox.” Measured, and no: in Validity’s 2024 seed data, blocking fell over the year while spam placement nearly doubled.^[14]

The rules that apply whatever the filter does#

Spam filters are about reputation; consent and opt-outs are also law. In the United States, CAN-SPAM requires honest headers and subject lines, a valid physical postal address and an opt-out honoured within 10 business days, with penalties of up to $53,088 per violating email.^[19] In the UK, PECR requires consent, or the narrow soft opt-in, before marketing email to individuals.^[20] The industry’s shared reference, written with both senders and mailbox operators, is M3AAWG’s Sender Best Communications Practices.^[21]