Why Are My Emails Going to Spam? A Fix List for Business Email

8 min read

When your business emails land in spam or junk, the cause is rarely what you wrote. Usually Gmail, Outlook or Yahoo cannot confirm that the email really came from your domain, or your domain or server has picked up a bad reputation. Both are fixable, mostly with a few DNS records, and you can check each one in minutes.

The big email providers stopped giving unverified mail the benefit of the doubt. Since February 2024, Gmail and Yahoo have required every sender to prove their domain with SPF or DKIM. Anyone who sends around 5,000 messages a day to Gmail needs SPF, DKIM and DMARC as well. Gmail stepped up enforcement in November 2025, including rejecting mail outright. Outlook.com has rejected mail from high-volume senders who don’t meet its rules since 5 May 2025.

Start here: all mail, or one provider?

  • Everything goes to spam, and it started suddenly. Something changed on your side: a new email provider, a new tool that sends in your name, or a password that leaked. Work through the list below from the top.
  • Only Gmail, or only Outlook. That provider distrusts your domain or your server. Steps 1 to 3 and step 5 matter most.
  • Only newsletters, receipts or order emails. The service that sends them isn’t set up to send for your domain. Go to step 4.

You will need access to your domain’s DNS settings, at the company you bought the domain from or wherever your DNS is hosted. Every fix below is a record you add there.

1. Your domain doesn’t say who may send its email (SPF)

SPF is a TXT record that lists the services allowed to send email for your domain. Without it, a receiving server has no way to tell your real emails from a stranger’s.

If Google Workspace is the only service that sends your email, the record is:

v=spf1 include:_spf.google.com ~all

If it is Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Keep one SPF record per domain. If your newsletter tool, website or booking system also sends as you, add its include: to that same record instead of creating a second one. Two SPF records on one domain don’t add up, they make SPF fail. SPF also allows no more than 10 DNS lookups, as Microsoft’s guide points out, so a record that includes a long chain of services can stop working. Google says a new record can take up to 48 hours to take effect.

2. Your emails aren’t signed (DKIM)

DKIM adds a signature to every email, which the receiving server checks against a key published in your DNS. It matters more than people think: SPF often fails when an email is forwarded, but a DKIM signature survives as long as the message isn’t changed.

  • Google Workspace: in the Admin console, go to Apps → Google Workspace → Gmail → Authenticate email. Pick your domain, generate a record (Google recommends 2048-bit), add it as a TXT record at your DNS host, then press Start authentication.
  • Microsoft 365: in the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Select your domain, publish the two CNAME records it shows (selector1._domainkey and selector2._domainkey), then switch signing on. Microsoft notes that until you do this, emails from your own domain aren’t signed with your domain’s key.

3. You have no DMARC record

DMARC tells receiving servers what to do with an email that claims to be from you but fails SPF and DKIM. It also sends you daily reports on who is using your domain. Gmail and Yahoo require it from bulk senders, and it is the only one of the three that can tell receivers to turn away fake email in your name.

Add a TXT record at _dmarc.yourdomain.com. Start with a policy that only watches:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Then tighten it slowly. Google suggests about a week on p=none while you read the reports, then quarantining a small share of failing mail, then rejecting it. Microsoft describes the same path, raising the share from 10% to 100%. Don’t jump straight to a strict policy: Outlook.com, Hotmail and Live addresses reject mail that fails DMARC under p=quarantine as well as p=reject. A service you forgot to add in step 1 would suddenly have its emails bounced.

4. Your newsletter or shop sends “as you” without being set up

Mailchimp, Shopify, booking systems and CRMs send email with your address in the From line. Unless you authenticate your domain with them, they fail the checks above.

  • Mailchimp: Profile icon → Account & billing → Domains → Start authentication. You add two CNAME records for DKIM and one TXT record for DMARC. Mailchimp can also do it for you through an automatic connection with some DNS providers.
  • Shopify: Settings → Notifications → Sender email. Add the CNAME records Shopify gives you and a DMARC record of at least v=DMARC1; p=none. Until you do, Shopify rewrites your sender address to one on shopifyemail.com, so customers see an address that isn’t yours.

5. Your domain or server is on a blocklist

Many mail servers turn away email from addresses on blocklists such as Spamhaus’s. Look your domain and your sending server’s IP address up in the free Spamhaus reputation checker (check.spamhaus.org): it shows whether you are listed, why, and how to ask to be removed.

If your email is sent from a shared hosting server, you share its reputation too. Google notes that what any sender on a shared IP does affects everyone else on it. Spamhaus says only the company responsible for that IP can ask for it to be delisted, so contact your host rather than Spamhaus.

For Gmail specifically, Google Postmaster Tools shows the spam rate your emails get from Gmail users, and whether SPF, DKIM and DMARC pass. You verify your domain with a DNS record first. Google says it may show nothing on low-volume days, and it is retiring the old domain and IP reputation dashboards.

6. Your mailbox or website has been hacked and is sending spam

People tend to check this last, but it is one of the ways a domain ends up on a blocklist.

  • A hacked mailbox sends spam from your real account, so it passes SPF, DKIM and DMARC. Warning signs include sent items you didn’t write, forwarding rules you didn’t create, and your account being blocked from sending. Microsoft 365 blocks a user from sending when more than half of their recent mail is spam. Google Workspace can permanently stop an account that sends spam. Change the password, turn on two-step verification, and ask your admin to check forwarding rules.
  • A hacked website or contact form can send spam from your server without anyone logging in. Spamhaus lists IP addresses that send bad mail because of hacked websites or content management systems. Its advice: take the site offline, remove infected files, update the CMS and plugins, change every password and add two-factor login. A listing usually expires about three days after the last detection, but only once the cause is fixed.

7. Your domain is new, or you suddenly send a lot more

Filters don’t know a new domain, and M3AAWG, the anti-abuse industry group, says an unknown reputation is treated much like a bad one. Sending a large list soon after registering a domain is one of the things that gets it flagged. The fix is patience: start with small volumes to people who expect your email and increase gradually. M3AAWG puts the warm-up at about six weeks on average.

The same applies to newsletters. Google asks senders to keep the share of recipients who mark them as spam below 0.1% and never to reach 0.3%. Only email people who asked for it, and make unsubscribing easy.

What Teyna checks

Teyna’s free check looks at your domain’s email protection, whether SPF and DMARC are published and set up correctly. It also looks for the outside signs that your website has been hacked, one of the ways a domain ends up on a spam blocklist. It can’t see inside your mailbox and it doesn’t change your DNS. It tells you what to add and where, in plain words.

Is your website safe? Find out in a minute.

The free check reads only what anyone on the internet can already see: the padlock, email protection, open backups and signs of a hack. No sign-up and no card. We only ask for your email to send you the link to your report.

Scan my site for free

Questions

Why are my emails suddenly going to spam?

Almost always because something changed. You moved to a new email provider and the old SPF record no longer lists it. A new tool started sending in your name. Your mailbox or website was hacked and sent spam. Or you started sending a lot more email from a new domain. Steps 1, 4, 6 and 7 above cover these.

Why do my emails go to spam in Gmail but not in Outlook?

Each provider runs its own filters on its own data. Gmail may distrust your domain while Outlook doesn’t, or the other way round. Check what Gmail sees in Google Postmaster Tools, and make sure SPF, DKIM and DMARC all pass. Those three are the basis every provider uses.

Will adding SPF, DKIM and DMARC fix it straight away?

The records themselves can take up to 48 hours to take effect. A damaged reputation takes longer. If your server was on a Spamhaus list because of a hacked site, the listing usually expires about three days after the problem is fixed.

Do I need DMARC if I only send a few emails a day?

Gmail and Yahoo only require it from bulk senders. It is still worth adding: a p=none record costs nothing, sends you reports, and is the first step to stopping strangers from sending email in your name.

Should my SPF record end with ~all or -all?

Google’s example for Workspace ends with ~all, and Microsoft recommends -all for Microsoft 365. What matters more is having a single SPF record that lists every service that sends email for your domain.

What do the errors 550 5.7.26, 5.7.515 and 5.7.509 mean?

They are rejections. Gmail uses 5.7.26 for email that fails authentication, for example under your domain’s DMARC policy. Outlook.com uses 550 5.7.515 for high-volume senders who don’t meet its SPF, DKIM and DMARC rules, and 550 5.7.509 for email rejected by DMARC. All three are fixed by the steps above.

sources