Email Going to Spam? How to Fix It
Emails land in spam for three main reasons: missing or misconfigured SPF, DKIM, and DMARC records; sending from a new or unauthenticated domain; or content that triggers spam filters.
Emails land in spam for three main reasons: missing or misconfigured SPF, DKIM, and DMARC records; sending from a new or unauthenticated domain; or content that triggers spam filters.
Why emails go to spam
Email providers filter spam using hundreds of signals, but three factors account for the majority of false positives (legitimate email mistakenly classified as spam). The first is authentication failure — the receiving server cannot verify that the email genuinely came from your domain. The second is sender reputation — a new domain or one with a history of complaints will be treated sceptically. The third is content — certain words, formatting, and link patterns trigger spam filters regardless of who you are.
Most deliverability problems are caused by the first factor. You can fix it by publishing three DNS records: SPF, DKIM, and DMARC. These records tell receiving mail servers that your email is legitimate, which dramatically improves inbox placement rates.
SPF, DKIM and DMARC explained
| Record | What it does | What happens without it |
|---|---|---|
| SPF | Lists which servers are authorised to send email for your domain | Spammers can forge your domain and receivers cannot tell the difference |
| DKIM | Adds a cryptographic signature to outgoing email that receivers verify against your DNS | Your email has no tamper-proof seal; modified messages cannot be detected |
| DMARC | Tells receivers what to do if SPF or DKIM checks fail (deliver, quarantine, or reject) | Each receiver decides independently, and you have no visibility into who is sending email using your domain |
Think of it as the three-layer security system for email identity. SPF says who is allowed to send. DKIM verifies the message has not been tampered with. DMARC tells the receiver what to do when something looks wrong and gives you reports on all email claiming to be from your domain.
Setup walkthrough
Setting up email authentication takes about 20 minutes. First, generate your SPF record. A basic SPF record that authorises your hosting provider’s mail servers looks like v=spf1 mx include:_spf.yourhost.com ~all. Add this as a TXT record in your DNS for the root domain.
Next, generate a DKIM key pair through your email provider. Most control panels including cPanel have a “DKIM” section that creates the keys automatically. You add the public key as a TXT record in your DNS, typically with a selector name like default._domainkey.
Finally, create a DMARC record. Start with a monitoring policy: v=DMARC1; p=none; rua=mailto:you@yourdomain.com. This tells receivers to send you XML reports about email authentication results without taking any action against failing email. After monitoring for a few weeks, you can tighten the policy to quarantine or reject.
Testing tools
Before you start sending important business email, test your authentication setup. Free tools like MXToolbox, Google Admin Toolbox, and DMARC Analyzer will check your SPF, DKIM, and DMARC records and flag any issues. You can also send a test email to a spam testing service like mail-tester.com, which gives you a score and a detailed breakdown of what is wrong.
Monitor your DMARC reports for a month after setup. These reports show you every server that is sending email claiming to be from your domain, whether authentication passed, and what actions receivers took. This is also the best way to detect phishing attempts using your domain before they become a problem.
Email deliverability best practices
Authentication is the foundation, but it is not the whole story. Maintain a clean mailing list by removing invalid addresses and allowing easy unsubscribes. Send consistently rather than in sporadic bursts — predictable sending patterns build reputation. Keep your email content balanced: avoid excessive images, limit the number of links, and do not use all-caps or excessive punctuation. Use a reputable sending address and make sure your reply-to address is monitored. Warm up new domains by sending small volumes initially and gradually increasing over several weeks.
What NOT to do
Some common responses to spam problems backfire. Do not buy email lists — purchased lists contain invalid and spam-trap addresses that destroy your sender reputation instantly. Do not use misleading subject lines or hide unsubscribe links — this is illegal in most jurisdictions and guarantees spam classification. Do not send from a shared IP address on a server with poor reputation without checking the neighbourhood first. And do not ignore DMARC reports — they contain the data you need to fix problems before they escalate.
Frequently asked questions
Use a free SPF validation tool like MXToolbox. It will query your domain’s DNS and tell you whether the SPF record exists, whether it is syntactically correct, and whether it covers all the servers that send email for your domain.
No. DNS allows only one SPF record per domain. If you have multiple, SPF validation fails and your email is more likely to be rejected. You need to merge all authorised senders into a single record.
The DNS records are effective as soon as they propagate, which is usually 1–2 hours but can take up to 48 hours. However DMARC reports and the full benefit of authentication may take a few days to stabilise as email receivers cache the new records.
For the best deliverability, yes. SPF and DKIM are the authentication methods. DMARC tells receivers what to do when those checks fail and provides reports so you can see who is sending email using your domain. Without DMARC, you have no visibility into authentication failures.
Yes, especially if you set the DMARC policy to p=reject before you have confirmed that all legitimate senders pass SPF and DKIM. The safest approach is to start with p=none, monitor the reports for a few weeks, fix any issues, and only then move to p=quarantine or p=reject.