Why are my emails going to spam? A step-by-step diagnosis

Find out where the problem happens

Compare the same campaign across providers and several recipient accounts. If one provider is affected, investigate it first; if several change together, look for shared changes in source, list, authentication or volume. Separate promotional and transactional streams because their sending systems and audiences may differ.

In logs, 4xx means temporary deferral and 5xx rejection. A 250 after message data means the receiving server accepted responsibility to deliver or report failure. It does not say the message landed in Inbox rather than Spam, another folder or quarantine. Save the full SMTP response and timestamp before changing anything. ^[1]

Read the receiving server’s authentication results

Open full headers from an affected mailbox and find the Authentication-Results field added by the receiving provider. It lists method/result pairs such as spf=pass, dkim=pass and dmarc=fail, sometimes with the evaluated domain. Check the service identifier; multiple results may appear. Ignore lookalike fields not added at the trusted receiving boundary. ^[2]

Compare the visible From domain with the SPF envelope domain and DKIM header.d. DMARC passes if at least one passing SPF or DKIM identity aligns with From. A DKIM pass only proves signature verification; it does not show that the signing domain matches what readers see. ^{[3] [8]}

Check the rules for the affected provider

For personal Gmail, bulk means 5,000 or more messages per day. Everyone needs SPF or DKIM; bulk senders also need both, DMARC and one-click unsubscribe for marketing/subscribed mail. Google’s Postmaster guidance is to stay below 0.10% spam and avoid 0.30% or higher. Since November 2025, Google says non-compliant traffic may face temporary or permanent rejections. ^{[3] [4]}

Yahoo requires SPF or DKIM for all senders and spam rate below 0.3%. Bulk senders need both, DMARC at least p=none that passes, and one-click unsubscribe for marketing/subscribed mail; honor opt-outs within two days. Yahoo defines bulk as significant volume but publishes no cutoff. Enforcement began February 2024 and unsubscribe enforcement June 2024; non-compliant mail may go to Spam or be rejected. ^{[5] [6]}

Microsoft applies its policy to Outlook.com consumer services, including Hotmail and Live.com. Its current support page defines high volume as 5,000 or more messages to those services from the same 5322.From domain. SPF and DKIM must pass; publish DMARC at least p=none, with SPF or DKIM aligned. Rejection with 550 5.7.515 took effect May 5, 2025. ^{[7] [8]}

Audit who is on the list and what they expected

Trace each segment to its source: signup, product registration, event, partner or import. Look for missing consent records, unchecked confirmation, addresses collected for another purpose and rising unknown-user bounces. Spamhaus identifies bought, rented and harvested lists as common spam-trap sources and says not to mail them. Stop sending to segments without permission; do not try to identify trap addresses. ^[9]

Compare topic and frequency with the signup promise; don’t turn a weekly subscription into daily mail. Review complaints and unsubscribes by source and campaign, then suppress those recipients. Yahoo says complaints and content affect reputation; Spamhaus recommends engagement and feedback signals to keep lists current. ^{[6] [9]}

Check what changed in volume or infrastructure

Plot daily volume by domain, IP, provider and stream. Flag sudden jumps, bursts, reactivated lists or a new domain/IP launched at full volume. Google recommends steady increases beginning with engaged recipients; Spamhaus recommends slow, consistent warm-up for new or idle assets. Reduce or pause the affected stream while finding the trigger, then resume gradually to people who asked for mail. ^{[3] [9]}

Check for new vendors or changes to return-path/DKIM domains, DNS, accounts or applications. On dedicated infrastructure, verify PTR and HELO/EHLO; these differ from SPF/DKIM/DMARC. For the record-by-record procedure, see Sky’s earlier Spamhaus post on HELO, PTR and A records. ^[9]

Inspect the domains and links in the message

Check the sending IP and domains in visible links, redirects, image hosts and headers against relevant reputation data. A domain blocklist may include domains from message headers and body URLs, not just sending IPs. If listed, investigate the cause and follow that list’s removal process; one listing need not explain filtering everywhere. ^[10]

Compare the Spam copy with an accepted version. Check for changed landing pages, redirects, tracking or third-party destinations; repair compromised links and make link labels clear. Confirm the From name, subject and message match subscriber expectations. Avoid guessing from generic ‘spam word’ lists; use provider results, complaints and the actual message.

When to bring in a specialist

Seek help if basic fixes fail, a listing returns repeatedly, one provider remains affected without a clear cause, or a migration/new IP/domain launch at volume coincides with the problem. Persistently high complaints after removing a bad source, authentication that passes but poor placement, and unexplained bounces or deferrals call for a review of logs, DNS, dashboards and list history—not more copy edits.

Gather monthly volume, platform (ESP/MTA), affected providers, start date and preceding changes. Bring bounce/deferral text, Postmaster Tools or SNDS evidence, full headers and blocklist results. A scoped audit can organize evidence into a prioritized diagnosis, but cannot guarantee Inbox placement.