Why Are My Emails Going to Spam? A Developer's Deliverability Triage Guide

"Why are my emails going to spam?" has a hundred plausible answers and, fortunately, a sensible order to check them in. Most advice starts with content (subject lines, "spam trigger words"), which is where you should look last. Modern filters at Gmail and Microsoft weigh authentication and sender reputation far more heavily than word choice. So triage the way a filter thinks: authentication first, reputation second, the bulk-sender rules third, content and engagement last.

Work through it in order and in most cases you'll find the problem within an hour.

Step 1: authentication (SPF, DKIM, DMARC and alignment)

Send a message to a Gmail address you control, open it, and click Show original. Gmail prints the verdict at the top and in the Authentication-Results header:

Authentication-Results: mx.google.com;
    spf=pass smtp.mailfrom=bounce.yourdomain.com;
    dkim=pass header.d=yourdomain.com header.s=s2026a;
    dmarc=pass header.from=yourdomain.com

You're looking for three passes and, critically, alignment: the domain that passed must match your visible From domain. spf=pass for your ESP's bounce domain does nothing for DMARC unless it aligns; it's often the aligned dkim=pass (header.d=yourdomain.com) doing the real work. If any of this is unfamiliar, the SPF, DKIM and DMARC explainer is the ten-minute version.

Common failures, in order of how often we see them:

• spf=permerror: your SPF record is malformed or over the 10-DNS-lookup limit. This one is silent: mail keeps flowing on DKIM alone until DKIM breaks, then everything fails at once.
• dkim=fail or missing: signing was never enabled at the provider (a published key that isn't signing does nothing), or a key rotation left mail signed with a selector that no longer resolves.
• No DMARC record, or p=none: not a spam cause by itself, but Gmail, Yahoo and Microsoft now require DMARC from bulk senders (see step 3), and no enforcement means spoofers can burn your domain's reputation for you.

You can check all three records in one shot with the free DMARC / SPF / DKIM checker. Don't proceed to step 2 until authentication passes aligned; nothing downstream can compensate for failing it.

Step 2: reputation (IP, domain and blocklists)

Filters score two reputations: the sending IP and the From domain. Either can sink you.

• Check the blocklists. Query the major DNSBLs. Spamhaus matters most; SpamCop and Barracuda are worth checking too. A Spamhaus listing on your sending IP or domain is a drop-everything problem; each list documents its own delisting process.
• Shared IPs mean shared fate. On a shared ESP pool, a spammy neighbour can drag the IP's reputation down. Reputable ESPs police their pools; if your provider's shared IPs keep appearing on blocklists, that's your answer. Dedicated IPs give control, but only make sense with steady volume; a dedicated IP sending 200 emails a week never builds reputation.
• Domain reputation is slower and stickier. It follows you across IPs. New domains start cold: sending 50,000 messages on day one from a fresh domain looks exactly like a snowshoe spam run. Warm up gradually over weeks, starting with your most engaged recipients.
• Instrument it. Register for Google Postmaster Tools. It's free and shows your spam-complaint rate, authentication results and bulk-sender compliance status as Gmail sees them. For Microsoft, SNDS gives a similar view of your IPs. Without these you're guessing.

Also verify your sending IP has valid reverse DNS (a PTR record that resolves back to a real hostname matching forward DNS). You can sanity-check DNS records with the free DNS lookup tool. Mail from an IP with no or generic rDNS gets filtered aggressively.

Step 3: the Gmail, Yahoo and Microsoft bulk-sender requirements

In February 2024, Gmail and Yahoo turned long-standing best practices into hard requirements. Microsoft applied similar rules to Outlook.com, Hotmail and Live addresses from May 2025, and since November 2025 Gmail has moved from warnings to actively rejecting a share of non-compliant mail. If you send 5,000+ messages a day to Gmail addresses, you must have:

• Both SPF and DKIM passing (not either/or), with the From domain aligned.
• A DMARC policy. p=none satisfies the letter of the rule, but see our guide on moving to p=reject for why you shouldn't stop there.
• One-click unsubscribe (RFC 8058): List-Unsubscribe and List-Unsubscribe-Post headers on marketing/subscribed mail, honored within two days.
• Spam complaint rate below 0.3% in Postmaster Tools, and ideally below 0.1%. Sustained rates above 0.3% get your mail filtered wholesale.
• Valid forward and reverse DNS, and delivery over TLS.

Below 5,000/day the authentication basics still apply: SPF or DKIM at minimum, valid rDNS, low complaint rates. Treat the bulk-sender list as the target regardless of volume. It describes what good sending looks like, and the thresholds are Gmail's to change.

Step 4: content and engagement signals

Only now, with authentication and reputation clean, is content worth your time:

• Link domains matter more than words. Every domain you link to carries its own reputation. URL shorteners and tracking domains shared with spammers hurt; linking a domain that's on a blocklist hurts a lot. Link your own domains where possible.
• Avoid classic structural tells: a single large image with no text, mismatched link text vs. href, sloppy HTML from an old template.
• Engagement is the long game. Gmail weighs how recipients treat your mail: opens, replies, "not spam" rescues versus deletes-without-reading and complaints. The practical lever is list hygiene: send to people who asked, prune addresses that haven't engaged in months (a sunset policy), and never buy lists. Purchased lists are full of spam traps, and trap hits do more damage than any subject line can repair.

The triage checklist

1. Send to Gmail, open Show original, and confirm spf=pass, dkim=pass, dmarc=pass, aligned to your From domain.
2. Run your domain through the DMARC / SPF / DKIM checker and fix permerror, missing DKIM, missing DMARC.
3. Check your sending IP and domain against Spamhaus (and SpamCop, Barracuda).
4. Verify PTR / reverse DNS on the sending IP.
5. Register with Google Postmaster Tools; check compliance status and spam rate (target < 0.1%).
6. If you send 5,000+/day: confirm SPF and DKIM, DMARC published, one-click unsubscribe headers.
7. New domain or IP? Warm up: ramp volume gradually to engaged recipients.
8. Audit link domains in your templates; drop shorteners.
9. Prune unengaged addresses; confirm you're only mailing people who opted in.
10. Re-test after each fix. Deliverability recovers in days-to-weeks, not minutes.

Keep it fixed

Deliverability isn't something you fix once; it's a state you drift out of: an SPF record accumulates one include too many, a DKIM selector vanishes in a DNS migration, someone relaxes the DMARC policy during an incident. CompleteStatus monitors your SPF, DKIM and DMARC records, alerts if SPF or DMARC disappears, and flags p=none, permissive SPF and missing DKIM selectors. A DNS monitor on your domain's TXT records adds an alert for any SPF edit. It all sits alongside uptime, SSL and security-header monitoring in one dashboard.

Start with the free DMARC / SPF / DKIM checker to see where your domain stands, then start monitoring free so you hear about the next regression before your customers' spam folders do. The free tier allows commercial use.