# Why your emails go to spam (and how to fix it)

> The real reasons emails land in spam, from domain authentication (SPF, DKIM and DMARC) to reputation and content, how to find out which one is yours and what to do about each.

Source: https://couryo.com/en/guides/emails-going-to-spam · Updated 2026-10-08

The spam filter at Gmail, Outlook or Yahoo does not read your email like a person. It answers three questions, in this order:

1. **Who really sent this?** Did the sender's domain authorize this server to speak for it? (SPF, DKIM and DMARC)
2. **Does this sender usually send things people want?** (domain and IP reputation, complaints, bounces)
3. **Does this message look like a scam or an ad?** (content, links, attachments)

The problem is almost always in the first question, and it is the easiest to fix. That is why this guide starts there.

## Short answer: check this first

- [ ] The sender domain publishes **SPF**, **DKIM** and **DMARC**, and the email passes all three.
- [ ] The email goes out through a service authorized in your DNS, not the hosting server's `mail()` function or "as" a `@gmail.com` address.
- [ ] The sending domain and IP are not on blocklists.
- [ ] You do not send to addresses that do not exist or to people who did not ask.
- [ ] The message has a text part, links on your own domain, no shorteners, and no invoices or payment slips as attachments.
- [ ] Password and order emails do not share a path with campaigns.

## See what the provider thought of your email

Before changing anything, look at what the recipient got:

- **Gmail:** open the message, click the three dots and **Show original**. `SPF`, `DKIM` and `DMARC` appear at the top with `PASS` or `FAIL`.
- **Outlook on the web:** open the message, click the three dots and **View > View message details**. Look for `Authentication-Results` with `spf=`, `dkim=` and `dmarc=`.
- **Any client:** the `Authentication-Results` and `Received` headers tell who signed it and where it passed.

If any of the three is `FAIL` or missing, start with the next section.

## 1. The domain is not authenticated

Without authentication, anyone could send email "as" you, so filters distrust everything from your domain.

| Record | What it proves | Sign of trouble |
|---|---|---|
| **SPF** | which servers may send for the envelope domain | `spf=fail` or `softfail`, two SPF records, more than 10 DNS lookups |
| **DKIM** | that the message was signed by the domain and not changed on the way | `dkim=none` or `fail`, signed with the service's domain instead of yours |
| **DMARC** | what to do when SPF and DKIM do not match the `From` domain | `dmarc=fail`, no record at `_dmarc` |

The detail that trips most people: **DMARC requires alignment**. DKIM passing is not enough; it must be for the same domain as the `From` (or a subdomain of it). An email with `From: hi@yourstore.com` signed only by `sending-service.com` passes DKIM and fails DMARC.

The step by step for all three, including Cloudflare, is in [How to set up SPF, DKIM and DMARC](https://couryo.com/en/guides/spf-dkim-dmarc.md).

## 2. The sending server cannot speak for your domain

Two very common cases:

- **A site or store sending through the hosting server's `mail()` function.** The email leaves a shared server without your domain's DKIM. It is the default for WordPress, many PHP systems and self-hosted ERPs.
- **A system that sends "as" the user.** The ERP sends the invoice with `From: salesperson@gmail.com`, but through a server that is not Gmail's. Gmail publishes a DMARC reject policy, so the receiver has to refuse it or send it to spam.

The fix is to send through a service authenticated on your domain, always with a `From` address of your own.

## 3. Reputation is low

Providers keep the history of your domain and of the sending IP. Reputation drops when:

- **many people mark it as spam.** Gmail asks for a complaint rate below 0.3%, and you want to be well under that;
- **many addresses do not exist** (old, bought or mistyped lists) and come back as hard bounces;
- **the domain is new** and started sending a lot at once, with no history;
- **the IP is shared with spammers.** On sending services, shared IP reputation depends on the other customers.

How to check:

- [Google Postmaster Tools](https://postmaster.google.com): domain reputation and spam rate at Gmail (needs daily volume to show data).
- Microsoft SNDS: IP data for whoever sends to Outlook and Hotmail.
- Blocklist lookups, such as Spamhaus, for the domain and the IP.

## 4. The recipient list is the problem

No setting saves a bad list. Send only to people who asked, remove right away anyone who bounced with "user unknown" (code `5.1.1`) or complained, and confirm the address at sign-up (that is what the confirmation email is for). A bought list or one "imported from the old spreadsheet" is the shortest path to spam, and sometimes to a suspended sending account.

## 5. The content looks like a scam

With good authentication and reputation, content weighs less, but it still counts:

- **link shorteners** (they hide the destination and are common in scams);
- **links to a domain different from the sender's**, for no reason;
- **image-only emails** with almost no text;
- **no text part** (HTML only);
- **invoices or payment slips as attachments**: fake ones are a common scam and filters distrust them. Send a link;
- **all-caps subjects**, full of exclamation marks or words like "free" and "urgent";
- HTML pasted from a word processor, with broken markup.

## 6. Transactional and marketing on the same path

If the newsletter and the password reset come from the same domain and service, a campaign with many complaints drags the password email down too. Split the streams (for example, a subdomain for marketing) and keep transactional clean: no ads in the password email.

## 7. The big providers' rules

- **Gmail and Yahoo (since February 2024):** every sender needs SPF or DKIM, valid reverse DNS on the IP and TLS. Senders of more than 5,000 a day need SPF **and** DKIM, aligned DMARC, one-click unsubscribe on marketing messages and a spam rate below 0.3%.
- **Microsoft (since May 2025):** senders of more than 5,000 a day to Outlook, Hotmail and Live need SPF, DKIM and DMARC. Without them, messages come back with code `550 5.7.515`.

## From symptom to cause

| What you see | Most likely cause | What to do |
|---|---|---|
| Spam at every provider | domain without authentication or alignment | publish SPF, DKIM and DMARC and check for `PASS` |
| Only Outlook and Hotmail refuse | missing DMARC, or IP on a Microsoft list | publish DMARC; read the refusal code |
| Started after a campaign | too many complaints or bounces | clean the list, pause marketing, split the streams |
| Only one kind of email goes to spam | content (link, attachment, image) | compare with an email that lands and remove the difference |
| Arrives hours late | provider deferring (`4xx` codes) for volume or reputation | slow down and read the server's answer |
| Bounces with an error | refusal with an SMTP code | look up the code in [SMTP error codes explained](https://couryo.com/en/guides/smtp-error-codes.md) |

## Where Couryo fits

If you want to stop guessing: Couryo sets up your domain's DNS with you (on its own when the domain is on Cloudflare), signs every email with your domain's DKIM, keeps transactional apart from marketing and shows, for each message, the destination server's original answer with a plain-words explanation and what to do. A deliverability agent checks your domain every week and warns you before it becomes a problem. See how it works in the [docs](https://couryo.com/en/docs/deliverability.md).

## FAQ

### Why does my email reach Gmail but go to spam at Outlook?

Each provider has its own filter and history. Microsoft is stricter with authentication for bulk senders and uses its own IP lists. Check that DMARC exists and aligns, and read the reply code when a message bounces.

### Does asking customers to click "not spam" fix it?

It helps that one person's history a little, but it does not fix the cause. If the domain is not authenticated or the list has problems, the next email lands in someone else's spam.

### Does switching sending services fix it?

Only if the service is the cause (for example, a shared IP with bad reputation or no DKIM on your domain). If the cause is the list or the content, the problem moves with you.

### How long does it take to get out of spam?

Once authentication is fixed, the improvement usually shows in the next sends. Reputation hurt by complaints takes longer: it recovers with steady sending to people who want your email.

### Do transactional emails go to spam too?

Yes, for the same reasons. The difference is that they usually get strong engagement (the person is waiting for them), so with proper authentication and a path separate from marketing they have the best odds of landing.