If your emails are going to spam, the receiving server does not trust that they came from you or that the recipient wants them. The usual causes are missing or misaligned SPF, DKIM and DMARC, a damaged sender reputation, or spam-like content. The fix is to find the cause in the message header and correct it at source.
What the problem looks like in practice
The pattern is familiar. Sales sends a quotation, the customer says a week later that nothing arrived, and a phone call reveals it sitting in their junk folder. Sometimes it only happens with Gmail or Outlook recipients; sometimes only with notifications from the website contact form or with invoices sent by the accounting software. Those differences are your first diagnostic clue.
Most companies respond by asking the recipient to add them to a safe senders list. That hides the problem for one customer, but new prospects, tender committees and suppliers still receive your mail in spam. A lasting fix lives in your sending setup, not in someone else's settings.
This guide is about diagnosis and repair. The records themselves are explained in SPF, DKIM and DMARC explained, and a clean first-time setup is covered in setting up email with your domain.
What it costs to leave it unfixed
A message filed as spam is more dangerous than one that bounces. The sender gets no error and nobody notices. Quotations expire, payment reminders go unread and tender correspondence misses its deadline, and the loss is usually misread as "the customer wasn't interested".
The large mailbox providers have also tightened their rules. Google's email sender guidelines require everyone sending to Gmail to set up SPF or DKIM, to have valid forward and reverse DNS (PTR) records for their sending domain or IP, to use TLS, and to keep the spam rate reported in Postmaster Tools below 0.3%.
From 5 May 2025, Microsoft began requiring SPF, DKIM and DMARC (at least p=none) from domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses. An update to the announcement says non-compliant messages are rejected with a 550 5.7.515 error rather than routed to Junk, so the problem can go beyond the spam folder to mail never arriving at all. (Microsoft Defender for Office 365 Blog — Outlook's New Requirements for High-Volume Senders)
Having the records is not the same as having them right. EasyDMARC's 2026 DMARC Adoption Report, which scanned 1.8 million domains, found that 52.1% have a DMARC record but only around 9% combine an enforcement policy with reporting. Without reading those reports, you cannot see which service is sending unauthenticated mail in your name.
Why emails go to spam: a symptom-to-cause diagnostic table
Before changing anything, get the full header of a message that landed in spam ("Show original" in Gmail, "View message source" in Outlook). The Authentication-Results line states the SPF, DKIM and DMARC verdicts plainly, so start there rather than guessing.
| Symptom | Likely cause | Where to look | First fix |
|---|---|---|---|
| Only mail from the web form, CRM or invoicing software goes to spam | That service is missing from SPF or signs DKIM with its own domain, so DMARC alignment fails | spf=fail or dmarc=fail; DKIM d= shows another domain | Add the service to SPF and have it sign DKIM with your domain |
| All mail, to all recipients | No SPF or DKIM, a second SPF record, or SPF exceeding 10 DNS lookups | spf=permerror, dkim=none | One clean SPF record; switch DKIM signing on |
| Mail from your own server, mostly at one provider | No PTR record, or the IP is on a blocklist | Reverse DNS lookup, blocklist check | Match PTR to your domain; request delisting |
| Started suddenly, recipients complaining | A compromised account sent spam and reputation dropped | Unusual outbound volume, sign-in logs | Reset passwords, end sessions, enforce MFA |
| Newsletters go to spam, one-to-one mail is fine | Stale lists, bounces, complaints, no unsubscribe | Bounce reports, Postmaster data | Clean the list, easy unsubscribe, separate sending subdomain |
| One type of message (e.g. a single image and a short link) | Content and link signals | The message body | Text-led content, visible links, share links instead of attachments |
The first row is one of the most common cases in small and mid-sized firms. Website forms, CRMs, e-invoicing portals and newsletter tools put your address in the From line but send from someone else's server. DMARC checks not only that authentication passes but that it aligns with the visible domain, which is why a service already listed in SPF can still fail DMARC.
Fixing emails going to spam: an 8-step plan
- Collect samples. Take full headers from at least three spam-foldered messages, across different recipients and sending sources. Never decide on a single example.
- Build a sender inventory. List everything that sends in your domain's name: the mail server, website, CRM, accounting and e-invoicing software, newsletter tool, printers and scanners, monitoring systems. Reading your DMARC reports shows what the list is missing.
- Simplify SPF. One record, only the services you actually use, no more than ten DNS lookups. Remove old
includeentries nobody can explain. - Have every service sign DKIM with your domain. Turn on the "sign with your own domain" option and publish the key it gives you; that is what creates alignment.
- Start DMARC in monitoring mode and tighten gradually. Collect reports at
p=none, move toquarantineonce all legitimate sources align, then toreject. - Check server reputation. If you send from your own server, verify the PTR record, TLS and blocklist status. Have the website send through an authenticated SMTP account rather than straight from shared hosting.
- Protect accounts and volume. One compromised mailbox drags down the whole domain's reputation. That makes business password security and multi-factor authentication deliverability measures as much as security ones.
- Separate and measure bulk mail. Send announcements and campaigns from a dedicated subdomain, to a clean list, with an easy unsubscribe, and review Google Postmaster Tools data monthly.
How long to wait after a change
DNS changes spread according to the record's TTL, while reputation recovers gradually. After a fix, send test messages to the same recipients for several days and compare the headers. Declaring the problem "solved" or "not solved" on the same afternoon is misleading.
Mistakes that make things worse
Some instinctive reactions deepen the problem. Carrying on sending from a blocklisted IP pushes reputation lower still. Ending SPF with +all tells the world anyone may send as you; it does not fix spam and it invites spoofing. Adding a second SPF record invalidates both. Signatures made of a single image, or pulling pictures from external servers, also hurt content signals; see corporate email signature management for keeping them central and simple.
Switching provider or domain is not a fix on its own either. If DKIM keys and SPF are not updated during an email migration, the new platform inherits the problem on day one. If you are choosing a new provider, look at how domains and DNS are managed alongside the criteria in how to choose business email.
Finally, domains impersonating you affect your reputation too. When customers receive fake mail from a one-letter-off domain, they start treating your genuine mail with suspicion; we cover this in lookalike domain attacks.
How we handle this at Digital Bridge
We do not fix spam problems by patching one DNS record. We look at every system that sends mail in your name:
- Discovery and diagnosis. Under our cyber security consultancy we examine the headers of affected messages, your SPF, DKIM and DMARC records, PTR and blocklist status, and build the sender inventory with you.
- Fixing how applications send. If your website forms send without authentication, we move them to authenticated SMTP as part of custom web software work, and configure your CRM system and invoicing software to sign with your own domain.
- One sending pattern for all integrations. Where ERP, invoicing and notification services all send mail, we bring them into a shared, auditable setup through system integrations. We cover how invoice notifications flow separately in e-invoice integration in Turkey.
- Staged enforcement with monitoring. We move DMARC from monitoring to reject step by step, guided by the reports, without cutting off any legitimate source.
Where Smart360 and SmartMail fit
In our own Smart360 suite, domains and DNS settings are managed from a single admin panel, together with users, departments and product access. There is nothing to install; the account opens as soon as payment is confirmed. Seeing your domain configuration in one place rather than across scattered consoles makes the inventory work above much easier.
The fastest way to wreck reputation is spam sent from a hijacked account. Smart360 Security puts human verification on sign-in screens, so password-guessing attacks are stopped before they reach the server. Mailbox passwords are generated by the system and stored encrypted with AES-256-GCM rather than handed out to staff. Sessions are listed with device details and can be ended remotely, and changing a password closes every session.
The other side of the coin is mail your customers send to you. SmartMail assesses every incoming message against 12 signals, including the sender's SPF, DKIM, DMARC and PTR checks, and explains its verdict in a written report. If a customer's message lands in quarantine, you can see why, for example a failed DMARC check on their side, and tell them exactly what to fix. Your organisation sets the quarantine threshold, and before you change it the system shows how many messages would be affected. Who releases legitimate messages from quarantine, and how quickly, is covered in our guide to email quarantine policy.
Next step
Start by gathering the full headers of three messages you know went to spam, plus a list of every system that sends mail in your domain's name. Then get in touch: we will read the headers with you, pin down the cause and set out a written order of fixes. For more on email infrastructure, browse our Business Email & Documents guides.