Things Explained

Why Are My Emails Going to Spam?
SPF · DKIM · DMARC — Explained in Plain English

Your newsletters land in junk folders. Your invoices go unanswered because they were never seen. In 2024, Google and Yahoo changed the rules for every business that sends email — and small businesses who never heard about it are paying the price. Here's what changed, and how to fix it.

Jump to the Fix

An email that lands in spam might as well never have been sent

The Rules Changed

Google & Yahoo enforce new sender requirements since 2024

It's Not Personal

Filters judge your domain's proof & reputation — not your words

Three Records

SPF, DKIM & DMARC prove your email is really from you

Usually Fixable

A few DNS records & better habits solve most spam problems

What's Actually Happening

Spam filters don't read your email the way a person does — they check your credentials first

Most business owners assume emails go to spam because of something they wrote — a word like “free,” too many exclamation points. Content plays a role, but it's a small one. Modern spam filtering is mostly about identity and reputation: Can this sender prove the email really came from the domain it claims? And does that domain have a history of sending mail people want?

Think of it like airport security. It doesn't matter how nicely you're dressed — if you show up without ID, you're not boarding. Email authentication (SPF, DKIM, and DMARC — explained below) is your ID. Your sending reputation is your travel history. An email without both gets pulled aside, no matter how legitimate the message is.

What Changed — And Why It's Hitting Small Businesses Now

In February 2024, Google and Yahoo began enforcing new requirements for anyone sending email to their users — which, between Gmail and Yahoo Mail, is most inboxes in America. Microsoft followed with similar requirements for Outlook. Authentication went from “best practice” to mandatory: unauthenticated email is now rejected or filtered to spam automatically.

Big companies had IT departments handle this quietly. Small businesses — who set up their email years ago and never touched it since — often discovered the change only when customers said “I never got your email.” If your deliverability suddenly got worse without you changing anything, this is very likely why.

Your Business Sends Two Kinds of Email — Both Are Affected

One-to-One Email

The email you type — invoices, replies, proposals

Sent through Gmail, Outlook, or your workspace account. Your email provider handles some authentication for you — but only if your domain's records are set up correctly. Broken records mean even a personal reply to a customer can land in junk.

Bulk Email

Newsletters, promotions, automated campaigns

Sent through platforms like Mailchimp, Constant Contact, Klaviyo, or your CRM. These are held to the strictest version of the new rules — full authentication, one-click unsubscribe, and a near-zero spam complaint rate. This is where most businesses are getting burned.

The takeaway: both kinds of email ride on the same thing — your domain's authentication records and reputation. Fix those once, at the domain level, and every email you send benefits. That's what the rest of this page walks you through.

The Three Records

SPF, DKIM & DMARC — in plain English

These three acronyms terrify business owners, but each one is just a small text record added to your domain's settings (called DNS) — set up once, working silently forever. Here's what each actually does:

The Guest List

SPF

Sender Policy Framework. A public list of which servers are allowed to send email for your domain — your email provider, your newsletter platform, your invoicing software. When mail arrives claiming to be from you, the receiving server checks: is this sender on the list? Not on the list = suspicious.

→ One record per domain — every sending service must be on it

The Wax Seal

DKIM

DomainKeys Identified Mail. An invisible digital signature stamped onto every email you send — like a wax seal on a letter. The receiving server checks the seal against a public key on your domain. If it matches, the email genuinely came from you and wasn't tampered with in transit.

→ Each sending service gets its own signature key

The Security Policy

DMARC

Domain-based Message Authentication, Reporting & Conformance. Your written instructions for what receivers should do when an email fails the SPF and DKIM checks: let it through anyway, send it to spam, or reject it outright. It also sends you reports — so you can see who's sending mail in your name.

→ Now required by Google & Yahoo for bulk senders

How they work together: SPF says who may send for you, DKIM proves each message wasn't forged, and DMARC ties them together with a policy — including checking that the “From” address your reader sees actually matches the domain that passed the checks (called alignment). All three live in your DNS settings, wherever your domain is managed (GoDaddy, Namecheap, Cloudflare, your host). Your email and newsletter providers supply the exact records to paste in — you don't have to write them from scratch.

Symptom Decoder

What your specific symptom usually means

“My emails go to spam” is several different problems wearing the same disguise. Match your symptom before you start fixing:

Your Symptom	Most Likely Cause	Severity
Everything goes to spam — even one-to-one replies to customers	Broken or missing authentication at the domain level, or a blocklisted domain	Urgent
Newsletters go to spam, but regular email is fine	Your bulk platform isn't authenticated for your domain, or list/complaint problems	Urgent
It suddenly got worse in 2024–2025 after years of being fine	The Google/Yahoo requirement changes — your setup no longer meets the minimum	Urgent
Only Gmail recipients (or only Outlook recipients) filter me	You're failing that provider's specific checks — often DMARC alignment or reputation with that provider	Fixable
My newsletter lands in the “Promotions” tab	That's not spam — Gmail is categorizing, not filtering. Your email was delivered	Normal
Emails bounce back entirely with an error message	Outright rejection — read the bounce message; it usually names the failed check or blocklist	Urgent
One specific company never receives my email	Their corporate filter is stricter than most — authentication plus a request to their IT to allow your domain usually solves it	Fixable
Customers get spam “from us” that we never sent	Your domain is being spoofed — exactly what DMARC with an enforcement policy prevents	Urgent

Test before you guess: free checkers will grade your setup in under a minute. Send an email to mail-tester.com's test address for an overall score with specifics, or look up your domain in a free SPF/DKIM/DMARC checker (MXToolbox is a common one). If you use Gmail, open one of your own emails and click “Show original” — it displays PASS or FAIL for all three checks right at the top.

The Root Causes

The 10 most common reasons email lands in spam

Listed roughly in order of how often we find them — and notice how far down the list “what you wrote” appears.

Reason 01 · Most Common

Missing or broken authentication records

No SPF, no DKIM, no DMARC — or records that were set up years ago and broke when you changed hosts, switched email providers, or rebuilt your website. Since 2024, this alone is enough to send everything to spam, because unauthenticated mail no longer gets the benefit of the doubt.

What to check: Run your domain through a free SPF/DKIM/DMARC checker. All three should exist and pass.

Reason 02

Sending newsletters from a free email address

Using [email protected] as the “From” address in Mailchimp or Constant Contact now fails automatically. Gmail's own DMARC policy forbids other services from sending as @gmail.com — so your newsletter looks like impersonation to every filter that checks. The fix is sending from your own domain ([email protected]).

What to check: What's the From address on your campaigns? If it ends in @gmail.com, @yahoo.com, or @aol.com, this is your problem.

Reason 03

Your newsletter platform was never verified for your domain

Every bulk platform has a “domain authentication” or “verify your domain” step that adds its DKIM keys to your DNS. Skip it, and your campaigns go out signed by the platform's shared domain instead of yours — which fails DMARC alignment and inherits the reputation of every other business on that shared setup, good and bad.

What to check: In your platform's settings, is your domain listed as authenticated/verified? Each platform's help docs walk through it.

Reason 04

No one-click unsubscribe — or hiding the unsubscribe link

The 2024 rules require bulk senders to support one-click unsubscribe and honor it within two days. Counterintuitive but true: making unsubscribing easy protects your deliverability — because someone who can't find the link clicks “Report spam” instead, and spam complaints damage your reputation far more than an unsubscribe ever could.

What to check: Reputable platforms handle this automatically if you're on a current plan and haven't disabled or buried the unsubscribe footer.

Reason 05

A high spam complaint rate

Google's threshold is brutal: keep complaints below 0.3% — that's three complaints per thousand emails — and ideally under 0.1%. Cross it and Gmail filters your mail broadly, not just for the people who complained. Complaints spike when people don't remember signing up, when frequency jumps suddenly, or when content doesn't match what they subscribed for.

What to check: Google Postmaster Tools (free) shows your exact spam rate with Gmail users. Anything trending toward 0.3% is an emergency.

Reason 06

Old, stale, or purchased email lists

Emailing a list you bought — or one you haven't touched in three years — is deliverability poison. Dead addresses bounce (high bounce rates signal spam), recipients who never opted in complain, and old lists contain spam traps: addresses maintained specifically to catch senders with bad practices. One trap hit can blocklist your domain.

What to check: Is everyone on your list someone who actually opted in, recently enough to remember you? Bounce rate over ~2% on a send is a red flag.

Reason 07

SPF record errors — too many services, or two records

SPF has technical traps: a domain may have only one SPF record (a second one added by a new service breaks both), and the record may only reference 10 other servers (each tool you add — email, newsletter, CRM, invoicing, booking software — uses some up). Businesses that added tools over the years often have an SPF record that's silently invalid.

What to check: An SPF validator will flag duplicate records and the “too many DNS lookups” error instantly.

Reason 08

A damaged domain reputation — sometimes not your fault

Filters remember. A past era of aggressive blasting, a hacked website quietly sending spam from your server, a compromised email account, or a contact form being abused by bots can all trash your domain's reputation — and land it on public blocklists — without you sending a single bad campaign yourself.

What to check: Run a blocklist check on your domain (MXToolbox does this free). If you're listed, the listing page explains why and how to request removal — after fixing the cause.

Reason 09

Sudden volume spikes from a quiet domain

A domain that normally sends 30 emails a week suddenly blasting 5,000 looks exactly like a compromised account — because that's what compromised accounts do. Filters respond by throttling or junking the send. New domains and new newsletter programs need to warm up: start small, send consistently, and grow volume gradually.

What to check: Launching a first newsletter to a large list? Break it into smaller sends over days or weeks rather than one giant blast.

Reason 10

Spammy content signals — real, but overrated

Yes, content still matters — a little. One giant image with no text, link shorteners (bit.ly), misleading subject lines, ALL-CAPS urgency, and sloppy HTML all add suspicion points. But here's the honest truth: with solid authentication and a good reputation, the word “free” won't sink you — and with broken authentication, the most tasteful email ever written still lands in junk.

What to check: Reasonable image-to-text balance, full links instead of shorteners, subject lines that match the content. Then stop worrying about “trigger words.”

The New Rules

The sender requirements — what's actually required now

Google and Yahoo split their requirements into two tiers. The strict tier officially applies to “bulk senders” (5,000+ messages a day to Gmail), but here's the practical reality: treat the strict tier as your target regardless of size. The thresholds are guidelines, filters reward full compliance at any volume, and Microsoft has extended similar rules to Outlook.

Tier 1 — Every Sender

The minimum to reach the inbox at all

Authenticate with SPF or DKIM (in practice: do both)
Send from a domain with valid DNS records
Keep spam complaint rates low
Don't impersonate Gmail or Yahoo addresses in your From line
Use a properly formatted, standards-compliant message

Tier 2 — Bulk Senders (Your Real Target)

Everything above, plus:

Both SPF and DKIM, passing
A DMARC policy published (even a monitoring-only one to start)
Alignment: the From address your reader sees matches the authenticated domain
One-click unsubscribe, honored within two days
Spam rate under 0.3% — ideally under 0.1%

The good news about DMARC: you don't have to jump straight to the strict setting. A starter policy of “p=none” satisfies the requirement while only monitoring — it reports on who's sending as your domain without blocking anything. Once the reports confirm all your legitimate services pass, you can tighten the policy to quarantine or reject, which is what finally stops scammers from spoofing your domain.

The Full Deliverability Audit — 12 Things to Verify

SPF record

Exists, valid, only one — and includes every service that sends for you?

DKIM signatures

Enabled for your email provider AND your newsletter platform?

DMARC policy

Published, with reports going somewhere someone actually looks?

Alignment

The From address readers see matches your authenticated domain?

Custom From domain

Campaigns sent from [email protected] — never a free address?

One-click unsubscribe

Present on every bulk send and honored within two days?

Spam complaint rate

Under 0.1% in Google Postmaster Tools, never approaching 0.3%?

Bounce rate

Under ~2% per send — dead addresses removed automatically?

List hygiene

Everyone opted in, engaged contacts prioritized, no purchased lists ever?

Blocklist status

Domain checked against major blocklists and clean?

Website security

Site and forms secured, so nothing sends spam from your domain behind your back?

Monitoring

Google Postmaster Tools set up, DMARC reports reviewed, deliverability checked monthly?

The Fix

A step-by-step plan to get back to the inbox

Work through these in order — measure first, authenticate second, then repair the habits and reputation.

1

Test Where You Stand

Send a real email to mail-tester.com's test address for a graded report. Check your domain against blocklists with MXToolbox. Set up Google Postmaster Tools (free) to see your reputation and spam rate with Gmail specifically. Ten minutes of testing tells you exactly which of the causes above are yours — no guessing.

2

Set Up SPF and DKIM in Your DNS

Log into wherever your domain is managed (GoDaddy, Namecheap, Cloudflare, your host). Your email provider (Google Workspace, Microsoft 365) and your newsletter platform each publish exact copy-paste instructions for their SPF and DKIM records — follow them for every service that sends email as your domain. One SPF record total; separate DKIM keys per service. Re-test after: records take minutes to a day to take effect.

3

Add a DMARC Record — Start in Monitoring Mode

Publish a starter DMARC policy set to “none” with a reporting address — it satisfies the new requirements immediately while only watching, not blocking. Review the reports for a few weeks to confirm all your legitimate services pass. Then tighten the policy (quarantine, then reject) so spoofed email pretending to be you gets stopped cold.

4

Fix Your Sending Identity

Switch every campaign's From address to your own domain ([email protected]), complete your newsletter platform's domain verification step so campaigns are signed as you, and confirm the one-click unsubscribe footer is active. If you've been sending from a free Gmail/Yahoo address, this single step often produces the most dramatic improvement.

5

Clean Your List and Your Habits

Remove addresses that have bounced or haven't engaged in a year (or run a gentle re-permission campaign first). Never import purchased lists. Send on a consistent schedule at consistent volume, make content match what people signed up for, and keep the unsubscribe link easy to find — an unsubscribe is a favor; a spam complaint is a wound.

6

Rebuild Reputation and Monitor Monthly

If your reputation took damage, recovery is gradual: authenticated sending, to engaged people, at steady volume, for weeks. Request removal from any blocklists after fixing the cause. Then make monitoring routine — Postmaster Tools and your platform's deliverability stats once a month, and a mail-tester check after any change to your email setup.

A realistic expectation: authentication fixes often improve deliverability within days — sometimes the very next send. Reputation repair is slower: expect several weeks of consistent good behavior before badly damaged domains fully recover. And no one inboxes 100% of the time; the goal is that your legitimate email reliably reaches the people who want it.

Ready for your emails to
actually be seen?

Our Snapshot Report reviews your entire online presence — and we can audit your email authentication, sending reputation, and list health, then explain what we found in plain English with a live walkthrough.

Get Your Snapshot Report Schedule a Free Consultation

✦ Part of Mindful Marketing's Things Explained series — see also Schema Markup 101

FAQ

Frequently asked questions

The Basics

SPF is the public list of servers allowed to send email for your domain. DKIM is an invisible signature on each email proving it really came from you and wasn't altered. DMARC is your instruction to the world's inboxes about what to do with email that fails those two checks — plus reports so you can see who's sending in your name.

Yes — SPF and DKIM at minimum, and DMARC is strongly recommended. The strictest rules formally target bulk senders, but the baseline requirements apply to everyone, and filters reward full authentication at any volume. There's also a protection angle: without DMARC, anyone on the internet can send email that appears to come from your domain — to your customers, in your name. Small businesses get spoofed constantly precisely because scammers know they haven't locked this down.

Because the rules genuinely changed. Before 2024, authentication was a best practice — unauthenticated mail was viewed skeptically but usually delivered. In February 2024, Google and Yahoo made it mandatory and began enforcing it in waves, and Microsoft followed for Outlook. Nothing about your email changed; the bar it's measured against did. Businesses whose setup was “good enough” for a decade found themselves below the new minimum overnight.

It's copy-paste work, not programming — your email provider and newsletter platform give you the exact records, and you paste them into your domain's DNS settings. Adding SPF, DKIM, or a monitoring-mode DMARC record cannot break incoming email, and done correctly it only helps outgoing email. The two real ways to cause trouble: creating a second SPF record instead of editing the existing one, and jumping straight to a strict DMARC policy before confirming all your services pass. Both are avoidable, and both are why a careful hand (or a pro) is worth it.

Changes to DNS can take anywhere from a few minutes to 24–48 hours to take effect everywhere — don't panic-test five minutes after saving.

Diagnosis

Three free ways, from easiest to most thorough: (1) If you use Gmail, open any email you've sent yourself, click the three-dot menu → “Show original” — SPF, DKIM, and DMARC each show PASS or FAIL at the top. (2) Send an email to the address at mail-tester.com for a graded report with plain-English explanations. (3) Look up your domain in MXToolbox to inspect each record and check blocklists.

No — and this confuses everyone. The Promotions tab is the inbox, just organized: Gmail sorted your email as marketing, which a newsletter is. Your email was delivered, counts as delivered, and is read by plenty of people who check that tab intentionally. You can nudge toward the Primary tab with more personal, less image-heavy formatting, but chasing it too hard makes newsletters worse. Spend that energy on the subject line instead.

Spam means the email was accepted and delivered — to the junk folder. Bouncing means it was refused entirely, and you get an error message back. Bounces are actually more useful diagnostically: the bounce message names the reason — a failed authentication check, a blocklist, a full mailbox, or an address that doesn't exist. If you're getting bounces, read them before doing anything else; they're the receiving server telling you exactly what's wrong.

Problems & Fixes

Authentication gets you eligible for the inbox; reputation gets you in. If records pass but placement hasn't recovered: (1) Check alignment — passing SPF/DKIM on the wrong domain (your platform's shared domain instead of yours) doesn't count. (2) Check Google Postmaster Tools for your domain reputation and spam rate — a damaged reputation heals over weeks of good sending, not instantly. (3) Check blocklists. (4) Look honestly at your list — if a chunk of recipients never engage, filters notice. Records are the foundation; the rest of the fix plan above is the building.

As a stopgap for a handful of important contacts, sure — asking someone to add you to their contacts or mark a message “Not spam” genuinely helps for that recipient, and those “not spam” clicks even help your reputation slightly. But as a strategy it fails: you can't ask hundreds of subscribers to rescue your newsletter, prospects who've never met you won't do it, and it treats the symptom while the authentication and reputation problems keep compounding. Fix the cause; use whitelisting as a bridge.

Your domain is being spoofed — someone is forging your address on the From line, which is trivially easy against a domain with no DMARC enforcement. This hurts twice: your customers get scammed in your name, and the flood of forged mail damages your domain's reputation. The fix is exactly the DMARC path in the plan above: publish the record, monitor the reports to confirm your legitimate services pass, then move the policy to quarantine and finally reject — at which point inboxes worldwide start discarding the forgeries automatically.

If the spoofed emails contain your real customer data (not just your address), that's a different and more serious problem — a possible breach — and worth immediate professional attention.

Usually not — because the reputation that matters most is attached to your domain, and it moves with you. A business with broken authentication and a tired list will have the same problems on Klaviyo that it had on Mailchimp. Switching helps in narrower cases: your current platform doesn't support proper domain authentication, or you're stuck in a badly-behaved shared sending pool. Fix your records and list first; evaluate platforms second.

Next Steps

Three situations are worth bringing in help for: (1) DNS makes you nervous — fair enough; it's the one place a typo has consequences, and this is fast work for someone who does it weekly. (2) Your domain is blocklisted or spoofed — removal requests and DMARC enforcement rollouts are sequencing-sensitive. (3) You've authenticated everything, waited a month, and placement still hasn't recovered — at that point the answer lives in DMARC reports and reputation data that take experience to read.

Absolutely. We audit your current setup (records, alignment, reputation, blocklists), implement SPF, DKIM, and DMARC correctly for every service that sends as your domain, walk your DMARC policy safely up to enforcement, clean up list and sending practices, and set up monitoring so it stays fixed. Reach out at 314-753-5323 or visit mindfulmarketing.biz/connect to get started.

Why Are My Emails Going to Spam?SPF · DKIM · DMARC — Explained in Plain English