Why are my emails going to spam? A plain-English diagnosis

Start with what receivers can check mechanically: is this mail really from your domain? Then look at what they judge: complaints, content and reputation.

By peekip editorialLast checked 5 Oct 20263 min read6 sources

On this page

Short answer

First make sure receivers can verify your mail. Gmail and Yahoo require every sender to have SPF or DKIM, and senders of more than 5,000 messages a day to also publish DMARC (p=none is enough) with alignment, one-click unsubscribe and a spam rate under 0.3%. If authentication passes and mail still lands in spam, the cause is reputation, complaints or content, which no DNS record fixes.

Two different questions

A receiving mail system asks two things. Is this message really from the domain it claims? That is authentication, and it is checkable with DNS records you control. Does the recipient want it? That is filtering, based on complaints, engagement, content and the sender’s history. Fix the first before guessing at the second.

What the big mailbox providers require

Requirement	All senders	More than 5,000 messages a day
SPF or DKIM	Gmail: SPF or DKIM.^[1] Yahoo: “SPF or DKIM at a minimum”.^[2]	Both SPF and DKIM
DMARC	Not required	Required. Gmail: “Your DMARC enforcement policy can be set to none.”^[1] Yahoo: at least p=none, and DMARC must pass.^[2]
Alignment	Not required	The From domain must align with the SPF or DKIM domain
Unsubscribe	Not required	One-click unsubscribe for marketing, plus a visible link
Spam rate	Gmail: under 0.3% in Postmaster Tools. Yahoo: under 0.3%.	Same 0.3% ceiling
Infrastructure	Forward and reverse DNS for sending IPs; TLS for Gmail	Same

So a small business sending invoices and replies does not *need* DMARC to reach Gmail today. It still helps: it is the only one of the three that tells receivers what to do with mail that fails, and it brings reports showing who sends as your domain.

The three records in one paragraph each

SPF is a TXT record listing the servers allowed to send mail for your domain. It has hard limits: evaluation may use at most 10 DNS-querying terms, and exceeding them is a permanent error.^[3]

DKIM adds a signature to each message. The public key lives in DNS at selector._domainkey.yourdomain, so receivers can verify the message wasn’t forged or altered.^[4]

DMARC ties them to the address people see. It passes when SPF or DKIM passes *and* is aligned with the From domain; RFC 9989 calls a match on the same organisational domain “relaxed alignment”.^[5] Microsoft’s documentation sums it up: a message passes DMARC if one or both of the aligned checks pass, and fails if both fail.^[6]

Run it on yours

Check your domain

The domain report checks SPF, DKIM, DMARC and more, then gives the exact record to paste at your DNS host.

A diagnosis in order

Run a domain report and fix anything marked missing or failing: one SPF record, a DKIM key for every service that sends as you, and a DMARC record starting at p=none with a rua address.
Check each sending service. Newsletters, invoicing tools, help desks and shops often send as your domain. Each needs either your SPF include or, better, DKIM with your domain.
Read your DMARC reports for a week. They show which sources pass and which don’t.
If everything passes and mail still goes to spam, look at what authentication can’t fix: recipients marking you as spam, sending to old or bought lists, sudden volume jumps, misleading subject lines, or links to domains with a bad history.

What no record can promise

Authentication is necessary but not sufficient. A perfectly configured domain can still be filtered if recipients don’t want its mail. Anyone promising “guaranteed inbox” from DNS changes alone is selling something.

Sources

Email sender guidelines · Google Workspace Admin HelpChecked 5 Oct 2026
Sender Best Practices · Yahoo Sender HubChecked 5 Oct 2026
RFC 7208: Sender Policy Framework (SPF) (Apr 2014) · IETF / RFC EditorChecked 5 Oct 2026
RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (Sep 2011) · IETF / RFC EditorChecked 5 Oct 2026
RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (May 2026) · IETF / RFC EditorChecked 5 Oct 2026
Set up DMARC to validate email in Microsoft 365 · Microsoft LearnChecked 5 Oct 2026