Why is my email going to spam? A diagnostic checklist for admins

Step 0: Get a real example

Diagnosing from "some of our mail goes to spam" wastes time. Ask for:

• one affected message, forwarded as an attachment (forwarding inline loses the original headers), or the raw headers copied from "Show original" or "View source";
• which mailbox provider it landed in (Gmail, Outlook.com, Microsoft 365, Yahoo, a corporate filter);
• whether the problem is new, and what changed around the time it started.

The provider matters. Gmail, Microsoft and corporate gateways weigh signals differently, and a fix for one may not affect the others.

Step 1: Read the authentication results

Find the Authentication-Results header that the receiving provider added (the topmost one). You're looking for three results:

spf=pass  smtp.mailfrom=bounces.example.com
dkim=pass header.d=example.com
dmarc=pass header.from=example.com

Then check the domain's records with the Email Record Lookup: it flags missing or broken SPF, DKIM and DMARC in one pass.

Step 2: Check the sending IP

Find the IP that handed the message to the receiver. It's in the topmost Received: header added by the receiver, in the form from host [203.0.113.25]. Run it through the Email Blacklist Check, which also verifies reverse DNS.

• Listed on a major list (Spamhaus SBL or XBL, SpamCop, Barracuda): this alone can explain junk placement or rejection. See getting off a blocklist.
• No PTR record, or a PTR that doesn't resolve back: Gmail treats this as a requirement failure. See reverse DNS for mail servers.
• Shared IP at an email service provider: you inherit your neighbours' reputation. Ask the provider about it, or move to a dedicated IP if your volume justifies one.

Step 3: Look at reputation signals

Mailbox providers increasingly judge the domain, not just the IP. Signals to check:

• Google Postmaster Tools shows your spam-complaint rate and compliance status for mail to Gmail. Keep complaints under 0.3%, ideally under 0.1%.
• Microsoft SNDS (Smart Network Data Services) shows how Outlook.com sees your sending IPs.
• Volume spikes. A sudden jump, such as a reactivated old list or a new campaign to everyone, looks like a compromised account.
• Engagement. Mail that's never opened or is deleted unread trains filters against you. Remove long-inactive recipients.
• Bounces. A high rate of "user unknown" means you're mailing old or purchased addresses.

Step 4: Check the message itself

Only once authentication and reputation are clean:

• Links to domains with poor reputation, or URL shorteners, raise spam scores.
• Image-only messages with little text are treated as suspicious.
• Mismatched display names ("PayPal" <billing@unrelated.example>) look like phishing.
• Missing one-click unsubscribe on marketing mail violates bulk-sender rules.
• Attachments: macros and archive files are commonly quarantined by corporate gateways.

Step 5: Fix, then verify with a fresh message

Change one thing at a time where you can, so you know what fixed it. After each change:

1. Wait out the DNS TTL of the record you changed.
2. Send a new test message to the same provider.
3. Compare the new Authentication-Results with the old.

Quick reference

• – SPF passes and aligns, or DKIM passes and aligns
• – DMARC record present with a policy
• – Sending IP not on major blocklists
• – PTR present and forward-confirmed
• – Complaint rate under 0.3% (Postmaster Tools)
• – No sudden volume spikes; inactive recipients removed
• – One-click unsubscribe on marketing mail

From the field: I have run into situations where the problem was simply too many lookups on SPF or using a subdomain that the SPF/DKIM/DMARC records either were not configured for or did not pass through to the subdomain from the root domain. You may have to configure a whole separate set of records to support subdomain email.

Sources

• Gmail email sender guidelines FAQ
• RFC 8601: Message header field for indicating message authentication status