Why your emails go to spam — six causes, in the order worth checking

When email starts landing in spam, almost everyone does the same thing: they open the message and start rewriting it. They remove the word “free”, take out an exclamation mark, delete an image.

It is the obvious move, because the content is the only part you can actually see. It is also, in most cases, the wrong one. Content is the sixth most likely cause on this list, and by a wide margin the least likely to be your problem.

The five causes ahead of it are invisible from inside your own inbox. That is precisely why they persist — you cannot fix what you have no way of noticing.

The short version

Filtering decisions are made in this rough order: can we verify who sent this, then what is this sender's history, then what is in the message. Most people start at the end.

First, find out which problem you have

Before changing anything, spend four minutes establishing what is actually happening. Guessing costs more than checking.

Read the headers

Send a message to a Gmail address you control. Open it, click the three-dot menu, and choose Show original. The top of that screen tells you most of what you need:

SPF:   PASS with IP 203.0.113.10
DKIM:  PASS with domain yourdomain.com
DMARC: PASS

If all three say PASS, skip to cause 3. If any says FAIL, NEUTRAL, SOFTFAIL or NONE, you have found your problem and it is one of the first two on this list.

Check whether it is universal or provider-specific

Send the same message to addresses at Gmail, Outlook, Yahoo and a smaller provider such as Fastmail or a business domain. Where it lands tells you a lot:

Pattern	What it points to
Spam everywhere, including small providers	Authentication or blocklisting — causes 1, 2
Spam at Gmail only	Complaint rate or engagement — causes 3, 4
Spam at Outlook only	Microsoft is stricter on new domains — cause 5
Inbox everywhere except one recipient	Their personal filter. Not your problem.
Was fine, changed suddenly	Something changed: DNS edit, new IP, or a bad send

Look at the actual numbers

Register for Google Postmaster Tools. It is free, it takes ten minutes, and it is the only place you can see your real Gmail complaint rate. Without it you are working blind on the single metric that matters most.

Worth knowing

Postmaster Tools was replaced with v2 in October 2025. The old High/Medium/Low reputation scores are gone, replaced by a binary pass/fail Compliance Status. If you set it up before then and have not looked since, the dashboard you remember no longer exists.

1. Authentication is failing

This is the most common cause and the least visible one. Nothing bounces. Nothing warns you. Your mail simply stops arriving, and the only signal is that replies dry up.

Three records have to exist and agree: SPF lists which servers may send as your domain, DKIM cryptographically signs each message, and DMARC tells receivers what to do when the first two fail.

Since February 2024, Google and Yahoo require all three from bulk senders — 5,000+ messages a day to their consumer domains. Microsoft joined in May 2025 with the same threshold, and moved to outright rejection in November 2025. Non-compliant mail now gets refused with a 550 5.7.515 error rather than quietly filtered.

The mistake that causes this most often

Publishing a second SPF record when one already exists. Two SPF records on one hostname is a permanent fail, not a warning. Every message from that domain loses SPF — including the mail that was working fine yesterday.

$ dig +short TXT yourdomain.com | grep spf1

# One line back?   Merge your new include: into it.
# Two lines back?  That is your bug. Combine them into one.

The merge looks like this:

BEFORE   v=spf1 include:_spf.google.com -all
         v=spf1 include:amazonses.com -all      <- second record, fatal

AFTER    v=spf1 include:_spf.google.com include:amazonses.com -all

Also watch for

SPF permits ten DNS lookups before it errors out, and every include: costs one. Three or four is normal. If you have accumulated eight or nine over the years, you are one integration away from a permanent failure that will look exactly like this one.

2. Everything passes, DMARC still fails

This one is worth understanding properly, because it is the cause people are least equipped to spot. You can have SPF passing, DKIM passing, and a correctly published DMARC record — and still fail DMARC completely.

DMARC does not simply ask “did SPF pass?” It asks a harder question: does the domain in the visible From: header match the domain that SPF or DKIM actually authenticated?

Here is a real configuration that fails:

From:         news@yourdomain.com     <- what the reader sees
Return-Path:  bounce@relay.net        <- what SPF checks
DKIM d=       relay.net               <- what DKIM signed

SPF:   PASS    (relay.net is authorised to send)
DKIM:  PASS    (the signature is mathematically valid)
DMARC: FAIL    (neither authenticated domain is yourdomain.com)

Both checks pass. The message still fails DMARC, because nothing aligned with the domain the recipient can see. This is the default state of many relay setups until you configure it otherwise, which is why so many people hit it without ever having done anything wrong.

The fix

Tell your sending provider to use your domain rather than theirs:

Set a custom Return-Path (sometimes called a bounce domain or custom MAIL FROM) on a subdomain of yours
Configure DKIM to sign with d=yourdomain.com

Every serious provider supports both. Look for a setting called “domain authentication”, “sending domain” or “verified domain”.

Only one of the two needs to align for DMARC to pass. Align both if you can — DKIM alignment is more valuable because it survives forwarding, and forwarding is exactly where SPF breaks.

3. Your complaint rate crossed a line

Authentication makes you eligible for the inbox. Recipient behaviour decides whether you stay there. The single most consequential number is the proportion of recipients who hit “report spam”.

Complaint rate	What happens
Below 0.1%	Google's recommended target. You are fine.
0.1% – 0.3%	Above target. You lose access to mitigation support.
0.3% and above	Enforcement. Google will likely block your domain regardless of how good your authentication is.

The number is far smaller than it sounds. Send ten thousand emails and thirty spam reports puts you at the enforcement threshold. Thirty people out of ten thousand — three hundredths of one percent.

Worse, Google calculates it daily rather than as a rolling average. One badly targeted send to a cold segment can trigger enforcement on its own.

The counter-intuitive fix

Make unsubscribing easier. Specifically, implement RFC 8058 one-click unsubscribe — two headers, not a footer link:

List-Unsubscribe: <https://yourdomain.com/u?t=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

This puts a native Unsubscribe button next to your name in Gmail, before the reader has even opened the message. The URL must unsubscribe immediately on a POST request — no confirmation page, no login — and you must process it within two days.

Why this lowers complaints

Someone who wants out of your list will take whichever exit is nearest. If unsubscribing means hunting for six-point grey text at the bottom of the message, the spam button is closer. An unsubscribe costs you one subscriber. A spam report damages your domain for everyone else on the list.

One exception: do not put these headers on transactional mail — password resets, receipts, shipping notices. People unsubscribe by accident and then cannot reset their password.

4. Nobody opens anything

Sustained low engagement is itself a spam signal, independent of complaints. A list where nobody opens anything looks statistically like a purchased list — because that is what purchased lists look like.

This is the cause that builds up invisibly over years. Every list accumulates addresses that were valid once: people who changed jobs, abandoned the account, or simply stopped caring. They do not bounce. They do not complain. They just sit there, quietly dragging your aggregate engagement down, until you cross whatever internal threshold Gmail is using that month.

The fix nobody wants to do

Stop emailing people who have not opened anything in six to twelve months.

It feels like self-sabotage. You built that list. Deleting a third of it to improve deliverability sounds like the sort of advice that gets you fired. But the arithmetic is straightforward: those subscribers were already not reading your email. Removing them does not cost you readers, because they were not readers. What it does is stop them suppressing delivery to the people who are reading.

A middle path, if deleting is too much: run a re-engagement sequence first. Three messages over two weeks, explicitly asking whether they want to stay, with a single obvious button. Whoever clicks stays. Everyone else gets paused — not deleted, just removed from regular sends, so the decision is reversible.

5. Your domain has no history

A brand-new domain with no sending history that suddenly emits ten thousand messages looks exactly like a spammer who registered a domain this morning — because that is the spammer's actual playbook.

Perfect DNS does not exempt you. Reputation is built by sending consistently over time, not by configuring records correctly. There is no way to short-circuit it.

The ramp

Days	Daily volume
1–3	50
4–7	100
8–14	500
15–21	1,000
22–30	5,000
31+	Increase around 30% per day while complaints stay flat

Send your most engaged people first. Opens and clicks from real humans build reputation faster than raw volume does. Mail your newest, most active subscribers during the ramp, and leave the cold end of the list until the end.

The signal to stop

If your complaint rate rises while you are ramping, hold volume where it is until it settles. Pushing through a rising complaint rate is how a domain gets blocked during warmup rather than graduating from it.

6. The content itself

Last, and least likely — but not zero.

Modern filters do not work from a list of forbidden words. The idea that writing “free” sends you to spam is roughly fifteen years out of date. Content-based filtering is now statistical and considers the message alongside everything else known about you, which is why the five causes above matter more.

Things that still genuinely hurt:

A single large image with almost no text. Filters cannot read images, so a message that is 95% image looks like an attempt to hide something.
Link shorteners. bit.ly and similar are heavily abused. Use your own domain for redirects.
Mismatched display names. A From: name that has nothing to do with the sending domain reads as a phishing pattern.
Broken or missing plain-text part. Send proper multipart messages. An HTML-only message is a mild negative signal.
Links to a domain with a bad reputation, including an affiliate link you did not vet.

What almost never matters: the word “free”, one exclamation mark, a capitalised word, or the specific phrasing of your subject line. Write for humans. If the subject sounds like something you would report as spam, that is a copywriting problem rather than a deliverability one.

The order to work through

If you do nothing else, do these in this sequence. Each step is roughly ten times more likely to be your problem than the one after it.

Check the headers. Show original in Gmail. If SPF, DKIM or DMARC is not PASS, stop here and fix it. Nothing else matters until they are.
Check alignment. Your From: domain must match either the Return-Path domain or the DKIM d= domain.
Check your complaint rate in Postmaster Tools. Above 0.1%, that is your problem.
Add one-click unsubscribe if it is not already there. It is mandatory for bulk senders and it lowers complaints.
Prune or pause anyone who has not engaged in six to twelve months.
Then, and only then, look at the message itself.

If you remember one thing

The order matters more than any individual fix. Rewriting subject lines while DMARC is failing is like repainting a car with no engine — a lot of visible effort producing no movement at all.

Requirements and thresholds verified July 2026 against published Google, Yahoo and Microsoft bulk sender guidelines. All three revise these periodically.