Why is my email going to spam? A diagnostic order of operations
Nine causes, checked in the sequence that finds the problem fastest — because the order matters more than the tools, and most people start at step seven.
Almost everyone troubleshooting this starts in the wrong place — rewriting subject lines, removing the word “free”, stripping images out of a signature. Content is real, but it is the seventh thing to check, not the first. Work the list in order and you will usually find the cause in the first three.
Establish the pattern first
Before checking anything, answer three questions: does it affect all recipients or only some providers? All your mail or only bulk sends? Did it start on a specific day? A provider-specific, date-specific problem is nearly always authentication or a blocklist. A gradual decline across everything is reputation.
1. Is authentication actually passing?
Not “is SPF published” — is all three of SPF, DKIM and DMARC passing on a real delivered message. Those are different questions, and the gap between them is where most of these cases live.
Send a message to a Gmail address you control. Open it, click the three dots and choose Show original. You want PASS beside all three lines. SOFTFAIL, NEUTRAL, NONE or a missing DKIM line all mean you have found your problem.
The fastest way to see the whole picture is our record checker, which flags the three faults that cause most failures:
- Two SPF records. A domain may have exactly one. Two make SPF fail outright — worse than none.
- DKIM published but never switched on. The key is in DNS, but nobody clicked the activation button in the mail provider’s console. Extremely common.
- No DMARC record. Since 2024 both Gmail and Microsoft expect one from volume senders. Absence alone affects placement.
If any of these apply, stop here and fix it before looking at anything else. Our registrar-specific guides cover the exact records for your DNS host and mail provider.
2. Are you on a blocklist?
Check both your domain and your sending IP against the major lists — Spamhaus, SORBS and Barracuda between them cover most of what matters. A listing is usually the explanation for a problem that started abruptly.
Two subtleties worth knowing. If you send through Google Workspace or Microsoft 365, the sending IP is theirs, not yours, so an IP listing is rarely your fault or your fix — a domain listing is. And if you are on shared hosting sending through the server’s own mail, you inherit every other account’s behaviour on that IP, which is reason enough to move mail to a dedicated provider.
3. Did the MX or DNS change recently?
A partial migration is a classic cause. Symptoms: some mail arrives, some vanishes, some is in spam, and behaviour differs by recipient.
dig yourdomain.com MX +short
You should see exactly one provider’s records. Two providers’ MX records in the same zone means mail arrives at whichever answers first, and the other mailbox silently misses messages. If you moved providers and left the old records “just in case”, that is your problem.
4. Does the From domain match the sending domain?
DMARC requires alignment: the visible From domain must match the domain that authenticated. Sending as you@yourdomain.com through a platform that authenticates as mailer.platform.com fails DMARC even when SPF and DKIM technically pass.
This is the one that catches contact forms, invoicing tools and CRMs. The fix is to complete the platform’s own domain-authentication step — publishing their CNAMEs so mail is signed as your domain — not to add their include to your SPF and hope.
5. How old and how active is the domain?
A domain registered last week has no sending history, and no history is treated as suspicious. There is no trick for this: send low volume to engaged recipients for a few weeks and it resolves itself.
The same applies after a long silence. A domain that sent nothing for a year and then issues 500 messages in an afternoon looks exactly like a compromised account, because that is a pattern compromised accounts produce.
6. Where did the list come from?
The uncomfortable question. Purchased, scraped or “verified” bought lists produce bounces and spam complaints, and both are weighted heavily. A handful of complaints against a small domain does lasting damage.
| Signal | Healthy | Trouble |
|---|---|---|
| Hard bounce rate | Under 2% | Above 5% |
| Spam complaint rate | Under 0.1% | Above 0.3% |
| Open rate | Above 15% | Under 5% |
If you are above the trouble column, no authentication fix will save the campaign. Clean the list, remove anyone who has not opened anything in a year, and stop importing addresses you did not collect yourself.
7. Now look at the content
Seventh, not first. Modern filters care far less about individual words than the folklore suggests, but a few things still hurt:
- Link shorteners. bit.ly and similar are heavily abused; link to your own domain instead.
- One big image and almost no text. A newsletter that is a single JPEG reads as an attempt to hide content from filters.
- Mismatched link domains. Anchor text saying one domain while the href points elsewhere is a phishing signature.
- No plain-text alternative. HTML-only mail is more suspicious than a proper multipart message.
- Attachments on first contact. Especially archives and documents with macros.
What almost never matters any more: the word “free”, one exclamation mark, or a coloured heading. Do not waste an afternoon there.
8. Is it one recipient’s gateway, not you?
If everything passes and only one organisation never receives you, the problem may be entirely at their end — a corporate gateway with an aggressive local rule, or a greylist you never satisfied.
Ask a contact there to check their quarantine and add your domain to their allowlist. It feels unsatisfying, but chasing your own configuration in this case is a waste of time.
9. The one nobody checks: is something else already sending as you?
The most overlooked cause. Someone has been spoofing your domain for weeks, receivers have been filtering that traffic, and your legitimate mail is now caught in the same judgement. From your side everything looks correctly configured — because it is.
You cannot see this without DMARC reports. Publish a record with a reporting address, wait a week, and read what arrives:
v=DMARC1; p=none; rua=mailto:you@yourdomain.com; fo=1
The reports list every IP sending as your domain. Anything you do not recognise is either a forgotten legitimate tool or a spoofer. Once you know which, move the policy to p=quarantine and then p=reject, and the spoofed traffic stops being delivered at all — which is what lets your own reputation recover.
This is the step that turns a recurring problem into a solved one, and it is the reason we treat DMARC as mandatory rather than optional.
How long recovery takes
Fixing the cause is quick. Reputation is not. Expect two to six weeks of consistent, modest, well-engaged sending before placement fully normalises, and do not try to accelerate it by sending more — that reads as exactly the wrong signal.
In the meantime: keep volume low, mail people who actually reply, and do not run a big campaign to prove the fix worked.
Want someone to just work the list?
We run all nine checks, fix the authentication properly for your registrar and mail provider, and send you a before-and-after test as proof. $49 flat, same day, money back if we cannot fix it.
Have us diagnose it — $49
