Why Your Business Emails Go to Spam (and How to Fix It)

Last updated: October 2026

A client mentions, three weeks late, that your quote "went to spam." An invoice sits in a junk folder until a payment reminder turns awkward. Your newsletter's open rate quietly halves, and the missing half is in spam folders too. When business email starts landing in spam, owners usually blame their subject lines or their email provider. The evidence points somewhere else first: at three DNS records most small businesses have never heard of.

Receiving mail servers — Gmail, Outlook, Yahoo — make a fast, mostly automated judgment about every message. The first question they ask is not "does this look like spam?" It's "can this sender prove it is who it claims to be?" That proof is email authentication, and when it's missing or broken, everything else you do is swimming upstream.

The 60-second test

Before changing anything, find out where you stand. Send an email from your business address to a personal Gmail address you control. Open it, click the three dots in the corner, and choose "Show original." Gmail displays a summary box with three rows: SPF, DKIM and DMARC, each marked PASS or FAIL (or missing entirely).

If any of the three doesn't say PASS with your domain beside it, you've found your first problem — and it's a mechanical one with a mechanical fix. If all three pass and mail still lands in spam, skip to the reputation and content sections below; your problem is a different one.

Cause 1: Authentication is missing or broken (check this first)

Three records work together:

• SPF is a DNS record listing every service allowed to send email as your domain — your mailbox provider, your newsletter tool, your invoicing app, your website's forms. If a service isn't on the list, its mail fails the check.
• DKIM is a digital signature each platform adds to your messages, verified against a key you publish in DNS. It proves the message wasn't altered and really came from an authorized platform.
• DMARC ties them together: it tells receivers what to do when a message claiming to be from your domain fails SPF and DKIM, and it gives you reports on who's sending as your domain.

The common failure patterns — the same ones that surface again and again in provider documentation and support threads:

It was never set up. Many domains have SPF because a setup wizard added it years ago, but DKIM was never turned on — in Microsoft 365 and Google Workspace alike, DKIM signing for your own domain is a manual step nobody took. DMARC is missing entirely on most small-business domains.

There are two SPF records. A domain may have exactly one. When a well-meaning tool or freelancer adds a second one instead of editing the first, receivers treat SPF as broken — a "permerror" — and the record protects nothing.

The SPF record is over the lookup limit. SPF evaluation allows at most 10 DNS lookups (the limit is set by RFC 7208, the SPF standard). Every include: you add spends some of that budget, and a few senders spend extravagantly: resolved live, Zoho's include alone chains to four more records — 5 of your 10, gone. Exceed 10 and SPF fails even though the record looks complete. We wrote a full guide on the too-many-lookups failure and its fixes.

A sender was forgotten. The setup was correct — for the senders someone remembered. Then the website's contact forms (sending through the web host), the CRM, or the invoicing app keep failing because nobody added them. Forgotten senders are the single most common reason a "finished" setup still leaks mail to spam.

DMARC was switched to reject too early. Jumping straight to p=reject before reports confirm every sender passes means your own legitimate mail starts getting refused. DMARC has a safe order of operations — monitor first, enforce later.

Cause 2: Sender reputation

If authentication passes everywhere and mail still filters, the next suspect is reputation — the receiving providers' memory of your domain's and your sending IP's past behavior. Reputation tanks when people mark your mail as spam (Google and Yahoo's bulk rules require a spam-complaint rate under 0.3%), when you mail addresses that don't exist (old purchased lists are the classic), or when a brand-new domain suddenly sends at volume.

Reputation problems don't have a DNS fix. The work is list hygiene (stop mailing people who never open; never buy lists), warming up volume gradually on a new domain, and time. Google Postmaster Tools (free) shows your domain's spam rate and reputation as Google sees it — check it before assuming.

Cause 3: Content and formatting

Only after authentication and reputation check out does content become the likely culprit: link shorteners, mismatched link text and destinations, image-only emails, and missing unsubscribe links on marketing mail. Since February 2024, Google and Yahoo require bulk senders (5,000+ messages a day) to include one-click unsubscribe in marketing mail — and Microsoft adopted matching requirements for Outlook.com in May 2025, rejecting non-compliant high-volume mail outright with error 550 5.7.515. Small senders aren't the target of those rules, but the same signals feed the same filters.

The order matters

If your mail worked until recently, start with emails going to spam all of a sudden — sudden breaks have their own short list of causes. If you want the fix as a straight sequence of steps, use how to get your emails to stop going to spam.

Work the causes in order — authentication, reputation, content — because each layer hides the next. A business that rewrites its newsletters while its DKIM has never been enabled is polishing the wrong thing. Fix the records first; most "spam problems" shrink to a fraction of their size, and the rest become diagnosable instead of mysterious.